CVE-2021-47506: nfsd: fix use-after-free due to delegation race

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-24 · updated 2026-08-04
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning.

Affected products

Linux kernel: before 4.4.296; from 4.5 before 4.9.294; from 4.10 before 4.14.259; from 4.15 before 4.19.222; from 4.20 before 5.4.168; from 5.5 before 5.10.85 — fixed in 4.14.259, 4.19.222, 4.4.296, 4.9.294, 5.10.85, 5.15.8

How to fix

Upgrade to a fixed version: Linux kernel 4.14.259, 4.19.222, 4.4.296, 4.9.294. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47506 or the next vulnerability affects your stack