PT-2024-8915 · Linux+4 · Linux Kernel+4
J. Bruce Fields
·
Published
2024-05-24
·
Updated
2025-05-29
·
CVE-2021-47506
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to a use-after-free error due to a delegation race in the nfsd component of the Linux kernel. A delegation break could arrive as soon as
vfs setlease is called, and a callback is run immediately in nfsd4 cb recall prepare, adding the delegation to del recall lru. If nfs4 set delegation exits without hashing the delegation, it will be freed as soon as the callback is done with it, without being removed from del recall lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. The bug may have been present since the beginning, but it is suspected that a specific commit made it easier to hit.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse
Ubuntu