CVE-2021-47506

What it actually does

Race between vfs_setlease and nfsd4_cb_recall_prepare can add an unhashed delegation to del_recall_lru; subsequent free leaves dangling references that later trigger use-after-free or list corruption, typically in the laundromat thread.

Why it matters to the business

NFS servers may experience kernel panics, memory corruption, or service outages that interrupt file sharing and require reboots or restarts.

How an attack unfolds

An attacker with NFS client access issues operations that cause the server to grant a delegation, then triggers a break callback before the delegation is inserted into the hash table; the callback frees the object while it is still referenced by del_recall_lru, leading to later corruption when the laundromat processes the list.

How to fix it

Apply the upstream patch that ensures the delegation is either hashed or removed from del_recall_lru before the callback can free it; rebuild and deploy the corrected kernel on all NFS servers.

How to confirm the fix worked

Boot the patched kernel, enable NFSv4 delegation serving, and run concurrent delegation-grant and recall workloads while monitoring for use-after-free or list corruption warnings in the kernel log.

Typical attack path

1. Establish NFS mount and request operations that result in a delegation grant
2. Force a delegation break via conflicting access or explicit recall
3. Time the break to occur between vfs_setlease and hash insertion
4. Allow the freed delegation to remain on del_recall_lru until the laundromat dereferences it

How to detect it

Search kernel logs and dmesg for "use-after-free" or "list corruption" messages originating from the NFS laundromat thread on systems that were running nfsd before the patch was applied.

What your security team should do

• Prioritize kernel updates on all systems running nfsd with NFSv4 delegations enabled
• Temporarily disable delegations via nfsd configuration if patching cannot be completed quickly
• Monitor kernel logs for laundromat-related warnings on NFS servers