CVE-2023-52909

What it actually does

Race condition in nfsd4_open allows a newly-created nfsd_file to have its PENDING bit cleared while hashed with NULL nf_file pointer, enabling NULL dereference oops, or clobbering of existing nf_file causing descriptor leaks in NFSv4 cached open handling.

Why it matters to the business

NFSv4 servers on affected Linux kernels risk crashes or resource leaks that reduce availability and stability; low current exploitation probability but kernel-level impact affects all dependent services until patched.

How an attack unfolds

An attacker connects to an NFSv4 server and issues compound operations that create or reference cached open files; by racing with the hash insertion and PENDING clear, the attacker triggers invalid nf_file state leading to kernel fault or leak.

How to fix it

Update the Linux kernel to a version containing commit 45c08a752982116f3287afcd1bd9c50f4fab0c28 or later; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit via git describe or version string; exercise nfsd4_open paths under concurrent load and verify absence of NULL-related oops in dmesg.

Typical attack path

1. Establish NFSv4 mount or connection to target server
2. Issue NFSv4 COMPOUND requests containing OPEN operations
3. Time concurrent requests to hit the window where nf_file is NULL or overwritten
4. Trigger kernel oops or observe resource exhaustion from leaks

How to detect it

Search kernel logs and dmesg for nfsd_file NULL pointer dereferences or oops during compound NFSv4 operations; monitor for unexpected file descriptor growth in nfsd processes.

What your security team should do

• Prioritize kernel upgrades on all NFSv4 servers within maintenance windows
• Temporarily restrict NFSv4 access or fall back to NFSv3 where feasible until patched
• Enable kernel panic-on-oops logging and central collection for rapid detection
• Review downstream package distributions for backported fixes