Skip to content
Heist/ feed
High

NFSD: free copynotify stateid in nfs4_free_ol_stateid()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg vi

Announced Source revision 1
Original source ↗

CVE-2025-40273

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-40273

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
        "lessThan": "935a2dc8928670bb2c37e21025331e61ec48ccf4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
        "lessThan": "b114996a095da39e38410a0328d4a8aca8c36088",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
        "lessThan": "839f56f626723f36904764858467e7a3881b975d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
        "lessThan": "29fbb3ad4018ca2b0988fbac76f4c694cc6d7e66",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
        "lessThan": "d7be15a634aa3874827d0d3ea47452ee878b8df7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
        "lessThan": "f67ad9b33b0e6f00d2acc67cbf9cfa5c756be5fb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
        "lessThan": "4aa17144d5abc3c756883e3a010246f0dba8b468",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/nfsd/nfs4state.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.6"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.6",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.247",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.197",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.159",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.117",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.59",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.17.9",
        "versionType": "semver",
        "lessThanOrEqual": "6.17.*"
      },
      {
        "status": "unaffected",
        "version": "6.18",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/nfsd/nfs4state.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-40273

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30704 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement