CVE-2021-47259

What it actually does

A use-after-free in nfs4_init_client() allows a dangling pointer to an nfs_client structure to be dereferenced after nfs_put_client() has freed it, triggered when mounting multiple exports to the same server over different network interfaces due to incorrect reference counting around clear_bit().

Why it matters to the business

Kernel memory corruption on Linux systems performing NFS mounts can cause crashes, denial of service, or potential privilege escalation, disrupting file services and server availability.

How an attack unfolds

An attacker hosts an NFS server with multiple exports and causes a victim system to mount them concurrently via separate NICs; the flawed refcounting frees the client object while nfs4_init_client() still holds a reference, enabling subsequent use of the freed memory.

How to fix it

Update the Linux kernel to a version containing the fix for the reference-counting error in nfs4_init_client(); rebuild and reboot systems that mount NFS exports.

How to confirm the fix worked

Confirm the running kernel contains the upstream patch, then reproduce concurrent multi-NIC mounts to the same server while monitoring for KASAN use-after-free reports.

Typical attack path

1. Locate or control an NFS server reachable by the target
2. Configure multiple distinct exports on that server
3. Induce the target to issue concurrent mount requests over different network interfaces
4. Trigger nfs4_init_client() to perform the final nfs_put_client() followed by a dereference of the freed structure

How to detect it

Inspect kernel logs and KASAN reports for use-after-free warnings involving nfs_client or nfs4_init_client during mount operations; correlate with unexpected NFS-related kernel panics.

What your security team should do

• Apply kernel updates to all systems that perform NFS mounts
• Review and restrict NFS client configurations to single-interface mounts where feasible
• Include NFS-related kernel paths in crash-dump and sanitizer monitoring