CVE-2021-47316

What it actually does

NULL pointer dereference in the Linux kernel NFSv3 XDR encoder nfs3svc_encode_getaclres when an error path leaves the dentry uninitialized or NULL.

Why it matters to the business

Local processes can trigger a kernel crash and denial of service on any system exporting NFS shares, interrupting file services until reboot.

How an attack unfolds

An attacker with local access crafts NFSv3 GETACL operations that force an error return; the encoder then dereferences the NULL dentry during response serialization, panicking the kernel.

How to fix it

Update the Linux kernel to a version containing commit 20798dfe249a or later that ensures status alone guarantees a valid dentry before encoding; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Confirm the patched encoder no longer performs unchecked dentry operations on error paths; reproduce error conditions with NFS clients and verify absence of NULL dereference oops.

Typical attack path

1. Obtain local execution on a host running the vulnerable nfsd
2. Issue NFSv3 requests that trigger error handling in getacl
3. Force the encoder to dereference a NULL dentry
4. Cause kernel oops and system reboot or hang

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic entries referencing nfs3svc_encode_getaclres or NULL dentry in the NFS server path.

• nfs3svc_encode_getaclres
• NULL dereference.*dentry
• general protection fault.*nfsd

What your security team should do

• Prioritize kernel upgrades on all NFS servers within the next maintenance window
• Monitor dmesg and kernel logs for nfsd-related NULL dereference crashes
• Temporarily restrict untrusted local accounts from accessing NFS exports if upgrades are delayed