CVE-2024-35914

What it actually does

The error bailout path added in nfsd_rename() fails to release the remount protection that was acquired, leaving the protection held on error and allowing subsequent rename operations involving directories without a common ancestor to violate locking assumptions.

Why it matters to the business

NFS servers on affected kernels may experience deadlocks or hangs during file rename operations under error conditions, reducing availability of shared storage and requiring reboots to recover.

How an attack unfolds

An attacker with write access to an NFS export triggers a rename between directories that have no common ancestor; when the operation hits the error path introduced by the earlier deadlock-avoidance change, the missing drop of remount protection leaves the filesystem in a locked state that can stall further operations.

How to fix it

Upgrade the Linux kernel to a fixed version such as 6.8.5 or later, or apply the commit 331e125e02c08ffaecc1074af78a988a278039bd in the stable tree; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking the presence of the corrected cleanup path in nfsd_rename() or by verifying the kernel version is at least 6.8.5; test rename operations that previously triggered the error path to ensure remount protection is released.

Typical attack path

1. Mount an NFS export from the vulnerable kernel
2. Issue rename operations between directories lacking a common ancestor
3. Force an error condition on the rename path
4. Observe that remount protection remains held, blocking subsequent filesystem activity

How to detect it

Review kernel logs for hung-task or deadlock warnings mentioning nfsd or remount protection; look for NFS rename operations that coincide with system unresponsiveness on affected kernels.

What your security team should do

• Prioritize patching NFS servers to 6.8.5 or newer within the next maintenance window
• Monitor for kernel oops or hung-task messages related to nfsd_rename
• Restrict NFS write access to trusted clients until patches are applied