CVE-2021-47507

What it actually does

Race condition between pernet ops registration and rpc_pipefs notifier allows rpc_pipefs_event to be invoked before nfsd_net_id is registered, resulting in NULL pointer dereference and kernel panic during mount operations.

Why it matters to the business

Unprivileged or routine NFS mount attempts can crash the kernel, causing denial of service, unplanned reboots, and loss of availability for file-sharing workloads on affected Linux systems.

How an attack unfolds

An attacker with local access performs concurrent mount operations against rpc_pipefs while nfsd pernet registration is still in progress; the notifier chain fires rpc_pipefs_event on an incompletely initialized netns, dereferencing a null pointer and panicking the kernel.

How to fix it

Upgrade the Linux kernel to a version containing the fix that restores register_pernet_subsys before register_cld_notifier and adds WARN_ON checks; apply the patch series referenced in the resolving commits bd5ae9288d64 and bb7ffbf29e76.

How to confirm the fix worked

Confirm the running kernel includes the registration-order fix; reproduce nfsd startup under concurrent mount load and verify absence of NULL dereference oops in kernel logs.

Typical attack path

1. Initiate nfsd module load or pernet registration
2. Trigger concurrent rpc_fill_super or mount syscall before register_pernet_subsys completes
3. blocking_notifier_call_chain invokes rpc_pipefs_event on unregistered netns
4. NULL dereference at offset in rpc_pipefs_event leads to kernel oops and panic

How to detect it

Search kernel logs and dmesg for NULL pointer dereference at virtual address 0000000000000012 together with the call trace containing rpc_pipefs_event in the nfsd module during mount syscalls.

• rpc_pipefs_event+0x54/0x120 [nfsd]
• Unable to handle kernel NULL pointer dereference at virtual address 0000000000000012
• pc : rpc_pipefs_event+0x54/0x120 [nfsd]

What your security team should do

• Prioritize kernel updates on all systems exposing NFS services
• Monitor kernel logs for rpc_pipefs_event NULL dereference patterns
• Limit unprivileged mount capabilities via mount namespaces or seccomp where feasible