Cloudanix VulnDB

CVE-2026-89708

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux file server code can let memory be used after it has been freed during certain client disconnect sequences, which may crash the server or allow an attacker to interfere with it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in nfsd callback handling: cl_cb_session pointer is dereferenced by rpciod tasks after DESTROY_SESSION frees the session via kfree, because nfsd4_probe_callback_sync and rpc_shutdown_client do not reliably wait for inflight rpc_tasks, and a second window exists in nfsd4_process_cb_update when __nfsd4_find_backchannel returns NULL.

Why it matters to the business

NFS servers can crash or become unstable under load when clients destroy sessions while callbacks are in flight, disrupting file access for dependent workloads and requiring emergency reboots or kernel updates.

How an attack unfolds

An attacker with network access to an nfsd server triggers repeated NFSv4 session creation and DESTROY_SESSION operations while ensuring pending callbacks are queued on rpciod; the teardown path frees the session before the callback task completes its dereference of cl_cb_session, leading to slab reuse and potential control-flow hijack or denial of service.

How to fix it

Apply the upstream fix that converts cl_cb_session to an RCU-protected pointer, moves the assignment after successful rpc_create, uses rcu_assign_pointer and rcu_dereference, switches __free_session to kfree_rcu, and updates all readers and tracepoints; rebuild and reboot to the patched kernel.

How to confirm the fix worked

Confirm the kernel source contains __rcu annotation on cl_cb_session, rcu_read_lock usage in encode_cb_sequence4args and nfsd4_cb_sequence_done, and kfree_rcu in __free_session; test by exercising session destroy under callback load and verify absence of use-after-free warnings in KASAN or kernel oops.

Typical attack path

  1. Establish NFSv4.1+ mount and create session with callback channel
  2. Issue operations that queue callback work items
  3. Send DESTROY_SESSION to unhash and begin teardown
  4. nfsd4_probe_callback_sync flushes workqueue but rpc_task remains on rpciod
  5. Session is freed while nfsd4_cb_sequence_done or related functions still read cl_cb_session
  6. Memory reuse triggers crash or exploitable slab state

How to detect it

Inspect kernel logs and vmcore for oops or KASAN reports mentioning nfsd4_cb_sequence_done, nfsd4_cb_prepare, cl_cb_session, or use-after-free in the nfsd module; correlate with NFSv4 DESTROY_SESSION and callback activity in audit or network traces.

  • nfsd4_cb_sequence_done
  • cl_cb_session
  • kfree_rcu.*session
  • nfsd4_process_cb_update
  • rpc_call_async.*nfsd

What your security team should do

  • Prioritize kernel upgrade for all systems running nfsd with NFSv4.1+ enabled
  • Monitor for nfsd-related kernel panics and enable KASAN or lockdep in test environments
  • Temporarily restrict NFSv4 callback usage or client session lifetimes if patching is delayed
  • Review downstream package builds that ship this kernel version for the RCU fix

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpc_task that dereferences clp->cl_cb_session. nfsd4_probe_callback_sync() flushes cl_callback_wq, but once nfsd4_run_cb_work() has called rpc_call_async() the rpc_task lives on rpciod; flushing the workqueue does not wait for it. rpc_shutdown_client() does drain rpciod tasks, but uses a 1-second wait_event_timeout — tasks stuck in rpc_delay() (e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain. destroy path rpciod ------------ ------ unhash_session(ses) nfsd4_probe_callback_sync(clp) flush_workqueue(cl_callback_wq) /* returns; rpc_task still live */ nfsd4_put_session_locked(ses) free_session(ses) -> kfree(ses) nfsd4_cb_sequence_done() reads cb_clp->cl_cb_session /* freed slab */ A second window exists in nfsd4_process_cb_update(). When __nfsd4_find_backchannel() returns NULL because unhash_session() has already removed the destroyed session from cl_sessions, setup_callback_client() takes the v4.1 early return so clp->cl_cb_session = ses never fires and the field retains a pointer to the about-to-be-freed session. Fix both by converting cl_cb_session to an RCU-protected pointer: - Move the cl_cb_session = ses assignment in setup_callback_client() to after rpc_create() succeeds, so it is only published when a working backchannel exists. Clear cl_cb_session on the error return in nfsd4_process_cb_update(). Both stores use rcu_assign_pointer(). - Annotate cl_cb_session with __rcu. All rpciod-side readers use rcu_read_lock()/rcu_dereference() and check for NULL, bailing to the appropriate error or requeue path: encode_cb_sequence4args(), decode_cb_sequence4resok(), nfsd41_cb_get_slot(), nfsd41_cb_release_slot(), nfsd4_cb_prepare(), and nfsd4_cb_sequence_done(). - Switch __free_session() from kfree() to kfree_rcu() so the session slab is not reclaimed until after an RCU grace period, guaranteeing that rpciod readers inside rcu_read_lock() never dereference freed memory. - Pass the session pointer to the nfsd_cb_seq_status and nfsd_cb_free_slot tracepoints instead of having them re-read cl_cb_session. - nfsd4_cb_prepare() calls rpc_exit() when the session is NULL, routing through the done/release path to requeue the callback.

Affected packages

Ecosystem Package Introduced Fixed