CVE-2024-26870

What it actually does

Local kernel BUG/oops triggered in nfs4_listxattr when listxattr() is called with size > 0 after generic_listxattr or nfs4_listxattr_nfs4_label consumes the buffer, leaving size=0 for nfs4_listxattr_nfs4_user and causing usercopy abort.

Why it matters to the business

Local users on systems using NFSv4.2 can trigger kernel crashes leading to denial of service, system reboots, and potential data loss or service disruption on affected Linux kernels.

How an attack unfolds

An attacker with local access on an NFSv4.2 mounted filesystem crafts a listxattr call that returns 'system.nfs4_acl' from generic_listxattr, then invokes listxattr with size=16 to exceed the remaining buffer and hit the missing size check, crashing the kernel.

How to fix it

Update Linux kernel to commit 4403438eaca6e91f02d272211c4d6b045092396b or later stable release containing the size check fix in nfs4_listxattr; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel version contains the listed commit; reproduce listxattr calls with size=16 on NFSv4.2 files and verify no BUG/oops occurs; monitor dmesg for absence of usercopy_abort during xattr operations.

Typical attack path

1. Obtain local shell or process execution on target Linux system with NFSv4.2 mount
2. Identify or create file with NFSv4 ACL xattr present
3. Call listxattr with zero size to learn required buffer
4. Call listxattr again with positive size that triggers partial consumption and zero remaining size
5. Trigger kernel BUG and system instability or crash

How to detect it

Review kernel logs for usercopy_abort, __check_object_size failures, or Oops involving listxattr and nfs4_listxattr; correlate with process activity calling listxattr on NFS mounts; examine audit logs for unusual xattr enumeration.

What your security team should do

• Prioritize kernel upgrade on all NFSv4.2 hosts within maintenance windows
• Restrict local user access to NFS mounts until patched where feasible
• Add kernel crash monitoring and alerting for usercopy_abort and listxattr paths
• Test patched kernels in staging before broad deployment