ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability

The Linux kernel's NFS server (nfsd) contains a reference-counting flaw in nfs4_preprocess_seqid_op(): on a replay retry where nfsd4_cstate_assign_replay() returns -EAGAIN because the replay stateowner is being torn down, the error path drops a stateowner reference it never acquired, risking a stateowner refcount underflow and use-after-free in kernel memory. The bug also leaks the stateid (stid) reference, which can stall concurrent close operations waiting on that refcount. A remote attacker who can act as an NFSv4 client to the server can trigger this path with crafted or replayed seqid operations, potentially achieving kernel memory corruption (privilege escalation or code execution in kernel context) or a denial-of-service crash/hang of the NFS service. Any Linux system exporting filesystems over NFSv4 with a vulnerable kernel is affected; there is no evidence of exploitation in the wild and no public proof of concept.

Do: Patch to a kernel release containing the upstream nfsd fix as soon as your distribution ships it, and prioritize NFS file servers and NAS appliances running nfsd. As mitigation, restrict access to TCP/2049 with firewall rules so only trusted client networks can reach NFS exports, and consider disabling NFSv4 exports on hosts that do not need them. Monitor for nfsd crashes, oopses, or hung CLOSE operations, which are indicative symptoms of this bug.