NFSD: free copynotify stateid in nfs4_free_ol_stateid()
In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg vi
CVE-2025-40273
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-40273
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "624322f1adc58acd0b69f77a6ddc764207e97241",
"lessThan": "935a2dc8928670bb2c37e21025331e61ec48ccf4",
"versionType": "git"
},
{
"status": "affected",
"version": "624322f1adc58acd0b69f77a6ddc764207e97241",
"lessThan": "b114996a095da39e38410a0328d4a8aca8c36088",
"versionType": "git"
},
{
"status": "affected",
"version": "624322f1adc58acd0b69f77a6ddc764207e97241",
"lessThan": "839f56f626723f36904764858467e7a3881b975d",
"versionType": "git"
},
{
"status": "affected",
"version": "624322f1adc58acd0b69f77a6ddc764207e97241",
"lessThan": "29fbb3ad4018ca2b0988fbac76f4c694cc6d7e66",
"versionType": "git"
},
{
"status": "affected",
"version": "624322f1adc58acd0b69f77a6ddc764207e97241",
"lessThan": "d7be15a634aa3874827d0d3ea47452ee878b8df7",
"versionType": "git"
},
{
"status": "affected",
"version": "624322f1adc58acd0b69f77a6ddc764207e97241",
"lessThan": "f67ad9b33b0e6f00d2acc67cbf9cfa5c756be5fb",
"versionType": "git"
},
{
"status": "affected",
"version": "624322f1adc58acd0b69f77a6ddc764207e97241",
"lessThan": "4aa17144d5abc3c756883e3a010246f0dba8b468",
"versionType": "git"
}
],
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.247",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.197",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.159",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.117",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.59",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.17.9",
"versionType": "semver",
"lessThanOrEqual": "6.17.*"
},
{
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-40273
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30704 · Revision 1
- Added to Heist Feed
- Publisher date