CVE-2024-26958

What it actually does

Double completion of nfs_direct_request in NFS direct write path due to out-of-order asynchronous commit handling, causing refcount underflow and use-after-free.

Why it matters to the business

Linux systems performing NFS direct writes risk kernel instability, crashes, or memory corruption; widespread kernel usage and Android ecosystem dependencies amplify operational disruption and patching urgency.

How an attack unfolds

Local attacker mounts NFS with direct I/O and triggers concurrent asynchronous commit requests; out-of-order completions invoke nfs_direct_write_complete twice, freeing the request structure while still in use. Threat actors targeting kernel flaws could chain the resulting UAF for privilege escalation or remote code execution.

How to fix it

Upgrade to Linux kernel containing commit 6cd3f13aaa62970b5169d990e936b2e96943bc6a; for Android apply fixed versions in frameworks/base for releases 13, 14, 15, and 16 as listed in 2025-09-01 updates. Wrap commit handling with nfs_commit_begin/end or equivalent get_dreq/put_dreq patterns.

How to confirm the fix worked

Confirm presence of the fix commit in kernel source or running version; run NFS direct-write stress workloads and verify absence of refcount underflow warnings in dmesg.

Typical attack path

1. Obtain local access on system with NFS direct writes enabled
2. Initiate concurrent direct write operations triggering async commits
3. Force out-of-order completion of commit requests
4. Trigger double nfs_direct_write_complete call
5. Exploit resulting use-after-free for memory corruption or code execution

How to detect it

Search kernel logs and dmesg for refcount underflow warnings originating from nfs_direct_write_schedule_work; correlate with nfsiod workqueue activity on systems using direct NFS writes.

• refcount_t: underflow; use-after-free
• nfs_direct_write_schedule_work
• WARNING: CPU.*at lib/refcount.c

What your security team should do

• Prioritize kernel and Android framework updates to fixed versions
• Monitor production NFS workloads for refcount warnings
• Consider disabling direct I/O on NFS mounts until patched if feasible
• Review logs for repeated nfsiod worker warnings indicating exposure