CVE-2021-47260

What it actually does

Potential NULL pointer dereference in nfs_get_client() within the Linux kernel NFS client code that callers do not handle, resulting in a kernel oops.

Why it matters to the business

May cause unexpected kernel crashes on systems performing NFS operations, reducing availability of file-sharing services, though the affected code path is likely unreachable in normal operation.

How an attack unfolds

An attacker would attempt to invoke nfs_get_client() under conditions that cause it to return NULL, leading unhandled callers to dereference the pointer and trigger a crash; the flaw is considered dead code with no known active exploitation.

How to fix it

Apply the upstream kernel commit that changes nfs_get_client() to return an ERR_PTR instead of NULL; update to a Linux kernel version containing the fix for this NFS handling path.

How to confirm the fix worked

Inspect the nfs_get_client() implementation in the running kernel source or binary to confirm it returns an error pointer on failure paths rather than NULL; review kernel oops logs for related NFS dereference patterns after patching.

Typical attack path

1. Trigger NFS client initialization or mount operations that reach nfs_get_client()
2. Force the function to return NULL via specific error or race conditions
3. Allow the NULL value to propagate to a caller that dereferences it without checks
4. Induce kernel oops and potential system instability or reboot

How to detect it

Search kernel logs and dmesg output for NFS-related oops or NULL dereference messages; correlate with NFS mount or client activity timestamps around any observed crashes.

What your security team should do

• Prioritize kernel updates containing the NFS client fix during the next maintenance window
• Monitor EPSS and KEV feeds for any change in exploitability signals
• Test NFS workloads on patched kernels to verify stability before broad deployment
• Review custom or out-of-tree NFS code that may call similar client functions