CVE-2024-50106

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix race between laundromat and free_stateid

There is a race between laundromat handling of revoked delegations

and a client sending free_stateid operation. Laundromat thread

finds that delegation has expired and needs to be revoked so it

marks the delegation stid revoked and it puts it on a reaper list

but then it unlock the state lock and the actual delegation revocation

happens without the lock. Once the stid is marked revoked a racing

free_stateid processing thread does the following (1) it calls

list_del_init() which removes it from the reaper list and (2) frees

the delegation stid structure. The laundromat thread ends up not

calling the revoke_delegation() function for this particular delegation

but that means it will no release the lock lease that exists on

the file.

Now, a new open for this file comes in and ends up finding that

lease list isn't empty and calls nfsd_breaker_owns_lease() which ends

up t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References