CVE-2025-40273

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: free copynotify stateid in nfs4_free_ol_stateid()

Typically copynotify stateid is freed either when parent's stateid

is being close/freed or in nfsd4_laundromat if the stateid hasn't

been used in a lease period.

However, in case when the server got an OPEN (which created

a parent stateid), followed by a COPY_NOTIFY using that stateid,

followed by a client reboot. New client instance while doing

CREATE_SESSION would force expire previous state of this client.

It leads to the open state being freed thru release_openowner->

nfs4_free_ol_stateid() and it finds that it still has copynotify

stateid associated with it. We currently print a warning and is

triggerred

WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]

This patch, instead, frees the associated copynotify stateid here.

If the parent stateid is freed (without freeing the copynotify

stateids associated with it),

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References