196 lines
11 KiB
JSON
196 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-89703",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-11T19:38:34.750Z",
|
|
"datePublished": "2026-09-11T19:46:20.280Z",
|
|
"dateUpdated": "2026-10-19T08:51:16.319Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T08:51:16.319Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations\n\nnfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked\ndelegations but does not set SC_STATUS_FREED before releasing cl_lock.\nrevoke_delegation() uses this flag to detect whether FREE_STATEID has\nalready processed the delegation -- without it, the freed delegation is\nadded to cl_revoked via list_add(), producing a use-after-free when\ncl_revoked is later traversed in __destroy_client().\n\nThe SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already\nsets SC_STATUS_FREED correctly. Apply the same pattern to the\nSC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid()."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The UAF is in nfsd nfsd4_drop_revoked_stid()/revoke_delegation() in fs/nfsd/nfs4state.c. A remote NFSv4 peer reaches it over TCP/2049 via svc_process to nfsd_dispatch to nfsd4_proc_compound: SEQUENCE then FREE_STATEID (ALLOWED_WITHOUT_FH), or a v4.0 op that hits nfsd40_drop_revoked_stid on an admin-revoked delegation.\nAC:L - The attacker holds a delegation and retries FREE_STATEID (or v4.0 use of that stateid) while nfsd4_revoke_states() unhashes with ADMIN_REVOKED and revoke_delegation() runs, then DESTROY_CLIENTID/expire so __destroy_client() walks cl_revoked. They control the NFS side of the race; unexport is a routine nfsd operational condition, not an uninfluenced layout.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with no cryptographic RPC authentication. Any host allowed by the export can EXCHANGE_ID/CREATE_SESSION or SETCLIENTID, OPEN to receive a delegation, and issue FREE_STATEID; no local Linux account or capability on the NFS server is required.\nUI:N - The attacker sends the NFSv4 compounds that obtain the delegation, FREE_STATEID, and client teardown. Administrative unlock_filesystem/unexport is a server operational condition (exportfs -u or volume detach), not a required victim user action such as mounting or opening a file.\nS:U - The use-after-free corrupts a kmalloc'd nfs4_delegation (deleg_slab) in the NFS server kernel. Impact stays in that host kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Without SC_STATUS_FREED, revoke_delegation() list_add()s a kmem_cache_free'd nfs4_delegation onto cl_revoked (KMEM_CACHE flags 0, not SLAB_TYPESAFE_BY_RCU). __destroy_client() then walks that freed object; slab reuse yields an arbitrary kernel-read primitive. Per guidance a UAF is C:H.\nI:H - list_add on the freed dl_recall_lru and later list_del_init/nfs4_put_stid in __destroy_client() write through reclaimed deleg_slab, including sc_free. That is a heap-spray write and control-flow hijack primitive. Per guidance a UAF is I:H.\nA:H - Use-after-free of nfs4_delegation when __destroy_client() traverses cl_revoked oopses or panics the nfsd thread even without full exploitation, fully denying service of the NFS server host."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfsd/nfs4state.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a",
|
|
"lessThan": "d832a0587528853d45481d1faf75d4b5d062adaf",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a",
|
|
"lessThan": "1e4795766719ffd74b8cf0f2fde4a1350f8326bf",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a",
|
|
"lessThan": "a6d89032e5c6620d5bb44582a72555ce07bf1c2e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a",
|
|
"lessThan": "650d370cfbc66a96dd14d517bd704689b5bda4e5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "967faa26f313a62e7bebc55d5b8122eaee43b929",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6.11.6",
|
|
"lessThan": "6.12",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfsd/nfs4state.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.12",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.12",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.109",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.50",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.4",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12",
|
|
"versionEndExcluding": "6.12.109"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12",
|
|
"versionEndExcluding": "6.18.50"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12",
|
|
"versionEndExcluding": "7.2.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12",
|
|
"versionEndExcluding": "7.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.11.6"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5"
|
|
}
|
|
],
|
|
"title": "nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |