CVE-2024-42078

What it actually does

Uninitialized nfsd_info.mutex can be dereferenced by svc_pool_stats_start immediately after netns creation, triggering a kernel oops.

Why it matters to the business

NFS server workloads on affected Linux kernels may experience unexpected crashes that interrupt file services and require reboots, with higher urgency for organizations running large numbers of Linux systems.

How an attack unfolds

An attacker with local access creates a new network namespace and immediately invokes svc_pool_stats_start on the nfsd_info structure before mutex initialization completes, causing the kernel to dereference an uninitialized pointer and panic.

How to fix it

Update the Linux kernel to the fixed commit e8f897f4afef0031fe618a8e94127a0934896aba or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit e8f897f4afef0031fe618a8e94127a0934896aba and verify that creating a netns no longer triggers an oops when svc_pool_stats_start is called.

Typical attack path

1. Obtain local user access on a system running a vulnerable kernel with nfsd enabled
2. Create a new network namespace
3. Trigger svc_pool_stats_start against the newly created netns
4. Cause kernel oops and potential denial of service

How to detect it

Review kernel logs for oops or panic entries referencing nfsd_info.mutex or svc_pool_stats_start shortly after netns creation events.

• nfsd_info.mutex
• svc_pool_stats_start
• kernel: Unable to handle kernel NULL pointer dereference

What your security team should do

• Apply the kernel patch containing commit e8f897f4afef0031fe618a8e94127a0934896aba as soon as possible
• Prioritize patching on systems exposing NFS services
• Monitor kernel logs for oops entries involving nfsd_info or svc_pool_stats_start