CVE-2021-47506

nfsd: fix use-after-free due to delegation race

State: Published
Severity: 9.8 Critical
Published: May 24, 2024
Updated: Aug 5, 2026
Reserved: May 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix use-after-free due to delegation race

A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru.

Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread.

I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	dff1399f8addf7129c49bb2227469da79cc30b47 to before 04a8d07f3d58308b92630045560799a3faa3ebceAffected dff1399f8addf7129c49bb2227469da79cc30b47 to before 348714018139c39533c55661a0c7c990671396b4Affected dff1399f8addf7129c49bb2227469da79cc30b47 to before 33645d3e22720cac1e4548f8fef57bf0649536eeAffected dff1399f8addf7129c49bb2227469da79cc30b47 to before 2becaa990b93cbd2928292c0b669d3abb6cf06d4Affected dff1399f8addf7129c49bb2227469da79cc30b47 to before e0759696de6851d7536efddfdd2dfed4c4df1f09Affected dff1399f8addf7129c49bb2227469da79cc30b47 to before eeb0711801f5e19ef654371b627682aed3b11373Affected dff1399f8addf7129c49bb2227469da79cc30b47 to before 148c816f10fd11df27ca6a9b3238cdd42fa72cd3Affected dff1399f8addf7129c49bb2227469da79cc30b47 to before 548ec0805c399c65ed66c6641be467f717833ab5Affected
LinuxLinux	3.17Affected before 3.17Not affected 4.4.296 through 4.4.Not affected 4.9.294 through 4.9.Not affected 4.14.259 through 4.14.Not affected 4.19.222 through 4.19.Not affected 5.4.168 through 5.4.Not affected 5.10.85 through 5.10.Not affected 5.15.8 through 5.15.*Not affected 5.16 and laterNot affected

Product

Versions

LinuxLinux

dff1399f8addf7129c49bb2227469da79cc30b47 to before 04a8d07f3d58308b92630045560799a3faa3ebceAffected
dff1399f8addf7129c49bb2227469da79cc30b47 to before 348714018139c39533c55661a0c7c990671396b4Affected
dff1399f8addf7129c49bb2227469da79cc30b47 to before 33645d3e22720cac1e4548f8fef57bf0649536eeAffected
dff1399f8addf7129c49bb2227469da79cc30b47 to before 2becaa990b93cbd2928292c0b669d3abb6cf06d4Affected
dff1399f8addf7129c49bb2227469da79cc30b47 to before e0759696de6851d7536efddfdd2dfed4c4df1f09Affected
dff1399f8addf7129c49bb2227469da79cc30b47 to before eeb0711801f5e19ef654371b627682aed3b11373Affected
dff1399f8addf7129c49bb2227469da79cc30b47 to before 148c816f10fd11df27ca6a9b3238cdd42fa72cd3Affected
dff1399f8addf7129c49bb2227469da79cc30b47 to before 548ec0805c399c65ed66c6641be467f717833ab5Affected

LinuxLinux

3.17Affected
before 3.17Not affected
4.4.296 through 4.4.*Not affected
4.9.294 through 4.9.*Not affected
4.14.259 through 4.14.*Not affected
4.19.222 through 4.19.*Not affected
5.4.168 through 5.4.*Not affected
5.10.85 through 5.10.*Not affected
5.15.8 through 5.15.*Not affected
5.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.