CVE-2025-40273
Description
In the Linux kernel, the following vulnerability has been resolved:
NFSD: free copynotify stateid in nfs4_free_ol_stateid()
Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period.
However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred
WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]
This patch, instead, frees the associated copynotify stateid here.
If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later.
[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In the Linux kernel's NFSD, a missing cleanup of copynotify stateid during state owner release triggers a warning and list corruption, fixed by freeing the stateid in nfs4_free_ol_stateid().
Vulnerability
In the Linux kernel's NFSD subsystem, a bug in state management allows a copynotify stateid to remain associated with a parent open stateid after the parent is freed during client reboot. The function nfs4_free_ol_stateid() does not free the copynotify stateid, leading to a kernel warning and potential list corruption when the laundromat later attempts to clean up the orphaned stateid [1][2][3].
Exploitation
An attacker can trigger this condition by performing a specific sequence: an OPEN to create a parent stateid, followed by a COPY_NOTIFY using that stateid, and then forcing a client reboot. The new client instance's CREATE_SESSION forces expiration of the previous client's state, hitting the bug in nfs4_free_ol_stateid(). No special privileges beyond normal NFS client operations are required.
Impact
Successful exploitation results in a kernel warning and list corruption, which can cause a system crash (Oops) or unstable behavior. The error message indicates an internal BUG, leading to denial of service.
Mitigation
The fix has been applied to the Linux kernel stable trees via commits [1], [2], and [3]. System administrators should update their kernels to include these patches to prevent the vulnerability.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3Patches
7935a2dc89286b114996a095d839f56f6267229fbb3ad4018d7be15a634aaf67ad9b33b0e4aa17144d5abVulnerability mechanics
Root cause
"Missing cleanup of associated copynotify stateids in `nfs4_free_ol_stateid` leads to list corruption during subsequent state management operations."
Attack vector
An attacker can trigger this vulnerability by establishing an NFS session, performing an `OPEN` operation, and then executing a `COPY_NOTIFY` operation using the resulting stateid. Subsequently, the attacker forces a client reboot or a new client instance creation, which triggers the server to expire the previous client's state. This process invokes `nfs4_free_ol_stateid` while the `copynotify` stateid remains associated, leading to list corruption when the `nfsd` laundromat later attempts to free the same `copynotify` stateid.
Affected code
The vulnerability is located in `nfs4_free_ol_stateid` within `fs/nfsd/nfs4state.c`. This function failed to properly clean up associated `copynotify` stateids when an open stateid was being released.
What the fix does
The patch modifies `nfs4_free_ol_stateid` to explicitly free any associated `copynotify` stateids when the parent stateid is being released [patch_id=11395]. This ensures that the `copynotify` state is correctly cleaned up, preventing the list corruption that occurred when the laundromat process later attempted to free the already-orphaned stateid.
Preconditions
- inputAn NFS client must have an active session with an open stateid and a subsequent copynotify stateid.
- inputThe server must be forced to expire the client's state, such as through a client reboot or a new client instance creation.
Generated on May 17, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- git.kernel.org/stable/c/29fbb3ad4018ca2b0988fbac76f4c694cc6d7e66nvd
- git.kernel.org/stable/c/4aa17144d5abc3c756883e3a010246f0dba8b468nvd
- git.kernel.org/stable/c/839f56f626723f36904764858467e7a3881b975dnvd
- git.kernel.org/stable/c/935a2dc8928670bb2c37e21025331e61ec48ccf4nvd
- git.kernel.org/stable/c/b114996a095da39e38410a0328d4a8aca8c36088nvd
- git.kernel.org/stable/c/d7be15a634aa3874827d0d3ea47452ee878b8df7nvd
- git.kernel.org/stable/c/f67ad9b33b0e6f00d2acc67cbf9cfa5c756be5fbnvd
News mentions
0No linked articles in our index yet.