VYPR
← All advisories
High severity7.8NVD Advisory· Published May 1, 2024· Updated May 12, 2026

CVE-2024-26958

CVE-2024-26958

Description

In the Linux kernel, the following vulnerability has been resolved:

nfs: fix UAF in direct writes

In production we have been hitting the following warning consistently

------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace:

? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30

This is because we're completing the nfs_direct_request twice in a row.

The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have

if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq);

However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice.

The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a

nfs_commit_begin(); nfs_commit_end();

Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths.

Fix this by using the same pattern for the commit requests.

Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free bug in the Linux kernel's NFS direct write path can cause a crash or potential privilege escalation (CVSS 7.8).

Vulnerability

Overview

The vulnerability is a use-after-free (UAF) in the Linux kernel's NFS (Network File System) direct write path. The root cause is a race condition where nfs_direct_write_complete() can be called twice for the same nfs_direct_request structure, leading to a refcount underflow and subsequent memory corruption [1]. The kernel's warning message refcount_t: underflow; use-after-free was consistently observed in production, confirming the bug.

Exploitation

Scenario

An attacker would need local access to the system, as the bug is triggered by normal NFS direct write operations under specific conditions. No special privileges are required beyond the ability to issue NFS I/O—for example, via a regular user mounting an NFS share or triggering direct writes through filesystem operations. The exploitation occurs when multiple commit requests are processed asynchronously; if one commit completes before the next is submitted, the completion routine erroneously finalizes the same request twice.

Impact

A successful exploit can lead to a kernel crash (denial of service) or, in some cases, arbitrary code execution with kernel privileges (high integrity impact). The CVSS v3 score of 7.8 (High) reflects this potential for privilege escalation [1].

Mitigation

Status

The fix has been merged into the mainline Linux kernel [2][3][4]. Users are advised to apply kernel updates from their distribution as soon as they become available. For systems that cannot be immediately patched, workarounds may include avoiding NFS direct writes or limiting access to the NFS client to trusted users only. The vulnerability is not known to be on the CISA KEV list at publication.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

127

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.