CVE-2024-36958

What it actually does

Uninitialized args.acl pointer passed to unconditional kfree() in nfsd4_encode_fattr4(), resulting in kernel memory corruption or crash during NFSv4 attribute encoding.

Why it matters to the business

NFS servers on affected kernels may crash or become unresponsive when processing certain file-attribute requests, interrupting file-sharing services and requiring restarts.

How an attack unfolds

An attacker sends crafted NFSv4 requests that reach nfsd4_encode_fattr4() without the ACL field having been initialized, triggering the unconditional kfree on an invalid pointer and causing a kernel fault.

How to fix it

Update to a kernel containing commit 6a7b07689af6e4e023404bf69b1230f43b2a15bc or later stable releases that include the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel contains the referenced commit or is newer than the vulnerable versions; confirm nfsd4_encode_fattr4() initializes args.acl before any early return paths.

Typical attack path

1. Establish NFSv4 mount or connection to target server
2. Issue NFSv4 operations that invoke fattr4 encoding with specific attribute flags
3. Trigger path where args.acl remains uninitialized
4. Kernel executes kfree on the garbage pointer and crashes

How to detect it

Review kernel logs for oops/panic traces containing nfsd4_encode_fattr4 or kfree calls from the NFS server path; correlate with NFSv4 traffic timestamps.

What your security team should do

• Prioritize patching kernel packages on all systems exposing NFSv4
• Monitor for kernel oops or panic logs mentioning nfsd4_encode_fattr4
• Temporarily restrict NFSv4 access from untrusted networks until patched