CVE-2024-50043

What it actually does

Concurrent FREE_STATEID operations on the same delegation stateid in nfsd4_free_stateid() allow the client lock to be dropped before nfs4_put_stid(), enabling a second operation to reference a freed stateid and trigger use-after-free or refcount underflow.

Why it matters to the business

Linux NFS servers may experience crashes or memory corruption, leading to service outages for file-sharing workloads; widespread kernel exposure increases operational risk for organizations relying on NFS, with prompt patching required given high ecosystem prevalence of the affected kernel code.

How an attack unfolds

An attacker with network access to an NFS server sends repeated FREE_STATEID requests targeting the same delegation stateid; the race in nfsd4_free_stateid() lets the second request act on an already-freed object, achieving use-after-free or refcount underflow. Espionage and financially motivated actors have conducted 2024 zero-day campaigns against similar Linux kernel flaws, and the pattern aligns with broader Linux kernel use-of-uninitialized-resource, out-of-bounds read, write, and access vulnerabilities observed in the wild.

How to fix it

Upgrade the Linux kernel to commit 7ca9e472ce5c67daa3188a348ece8c02a0765039 or later stable release containing the fix; for Rocky Linux 8 systems also ensure cyrus-sasl is at 2.1.27-6.el8_5 or newer; apply vendor kernel updates immediately and reboot NFS servers.

How to confirm the fix worked

Confirm the running kernel contains commit 7ca9e472ce5c67daa3188a348ece8c02a0765039 via uname or source inspection; test that repeated FREE_STATEID calls no longer produce refcount underflow or use-after-free warnings in dmesg; scan for unpatched kernel versions across the fleet.

Typical attack path

1. Establish network reachability to an NFSv4 server exporting delegations
2. Obtain or guess a valid delegation stateid
3. Issue multiple concurrent FREE_STATEID operations for that stateid
4. Trigger the window where the client lock is released before put_stid
5. Cause the kernel to dereference or decrement the freed stateid object

How to detect it

Review kernel logs for nfsd stateid-related warnings, refcount underflow messages, or use-after-free stack traces around nfsd4_free_stateid; correlate with NFSv4 FREE_STATEID traffic volume spikes from untrusted sources; inspect audit logs for unusual delegation stateid operations.

What your security team should do

• Prioritize kernel upgrades to the listed fixed commit on all NFS servers within the next maintenance window
• Monitor EPSS and threat-intel feeds for any rise in exploitation of this class of nfsd races
• Restrict NFSv4 delegation traffic to trusted clients until patches are deployed
• Enable kernel hardening features such as refcount_t checks and KASAN in test environments to validate the fix