CVE-2026-22980

In the Linux kernel, the following vulnerability has been resolved:

nfsd: provide locking for v4_end_grace

Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly.

We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock.

nfsd4_end_grace() is also called by the landromat work queue and this doesnt require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access.

However, we must be sure that writing to v4_end_grace doesnt restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held.

So this patch adds a nfsd_net field client_tracking_active which is set as described. Another field grace_end_forced, is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This grace_end_forced field bypasses other checks for whether the grace period has finished.

This resolves a race which can result in use-after-free.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/06600719d0f7a723811c45e4d51f5b742f345309
• https://git.kernel.org/stable/c/2857bd59feb63fcf40fe4baf55401baea6b4feb4
• https://git.kernel.org/stable/c/34eb22836e0cdba093baac66599d68c4cd245a9d
• https://git.kernel.org/stable/c/53f07d095e7e680c5e4569a55a019f2c0348cdc6
• https://git.kernel.org/stable/c/ba4811c8b433bfa681729ca42cc62b6034f223b0
• https://git.kernel.org/stable/c/ca97360860eb02e3ae4ba42c19b439a0fcecbf06
• https://git.kernel.org/stable/c/e8bfa2401d4c51eca6e48e9b33c798828ca9df61