Re: [BUG] NFSD: write_unlock_fs() has the same pre-shutdown-check UAF that 92ea163c773c just fixed for the netlink command
"Chuck Lever" <[email protected]> Sat, 01 Aug 2026 21:50:12 -0400
| Newsgroups | gmane.linux.nfs |
|---|---|
| Message-ID | <[email protected]> |
Hello George -
On Sat, Aug 1, 2026, at 3:32 PM, George Chapman wrote:
> Hi all,
>
> Bit of context, my name is George Chapman and I'm a cyber security
> researcher from the UK.
> I'm sure you get a lot of these but recently I've been exploring
> AI-assisted tooling as part of my own security research, using it alongside
> manual code review to look for bugs on local Linux builds.
>
> I've recently found something and want to raise it with you please,
> essentially this report is a product of that process, an LLM helped me
> trace through the code under my direction, with everything checked by hand
> before sending.
Commit 208b023eef24 ("NFSD: Prevent post-shutdown use-after-free in
unlock_filesystem") is already queued in the nfsd-next branch.
You can search the linux-nfs@ list archive on lore.kernel.org as part
of your research to determine whether an issue like this has been
previously reported or fixed.
--
Chuck Lever