CVE-2024-26629

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix RELEASE_LOCKOWNER

The test on so_count in nfsd4_release_lockowner() is nonsense and

harmful. Revert to using check_for_locks(), changing that to not sleep.

First: harmful.

As is documented in the kdoc comment for nfsd4_release_lockowner(), the

test on so_count can transiently return a false positive resulting in a

return of NFS4ERR_LOCKS_HELD when in fact no locks are held. This is

clearly a protocol violation and with the Linux NFS client it can cause

incorrect behaviour.

If RELEASE_LOCKOWNER is sent while some other thread is still

processing a LOCK request which failed because, at the time that request

was received, the given owner held a conflicting lock, then the nfsd

thread processing that LOCK request can hold a reference (conflock) to

the lock owner that causes nfsd4_release_lockowner() to return an

incorrect error.

The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it

never sen

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References