CVE-2024-46696

What it actually does

Use-after-free in the Linux kernel NFS server when nfsd4_cb_getattr_release drops a delegation reference before accessing embedded fields.

Why it matters to the business

NFS servers on affected kernels may experience crashes, data corruption, or potential remote code execution, leading to service outages and requiring emergency patching.

How an attack unfolds

An attacker interacts with an NFS server to trigger a delegation callback, causing the release function to access freed memory after the delegation reference is dropped.

How to fix it

Upgrade the Linux kernel to a version containing commit e0b66698a5ae41078f7490e8b3527013f5fccd6c or later; apply the fix from the stable tree.

How to confirm the fix worked

Verify the running kernel contains commit e0b66698a5ae41078f7490e8b3527013f5fccd6c; test NFS delegation callbacks under load to confirm absence of UAF.

Typical attack path

1. Establish an NFS mount and request a delegation
2. Trigger conditions that invoke nfsd4_cb_getattr_release
3. Force the delegation reference drop before field access
4. Trigger the use-after-free condition to corrupt kernel memory

How to detect it

Review kernel logs for nfsd-related oops or slab errors; inspect NFS traffic for unusual delegation callback patterns.

What your security team should do

• Prioritize kernel upgrades on all NFS servers within 30 days
• Monitor for kernel oops or crashes related to nfsd
• Restrict NFS exposure to trusted networks until patched