CVE-2024-46682

In the Linux kernel, the following vulnerability has been resolved: nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of sc_type") states_show() relied on sc_type field to be of valid type before calling into a subfunction to show content of a particular stateid. From that commit, we split the validity of the stateid into sc_status and no longer changed sc_type to 0 while unhashing the stateid. This resulted in kernel oopsing for nfsv4.0 opens that stay around and in nfs4_show_open() would derefence sc_file which was NULL. Instead, for closed open stateids forgo displaying information that relies of having a valid sc_file. To reproduce: mount the server with 4.0, read and close a file and then on the server cat /proc/fs/nfsd/clients/2/states [ 513.590804] Call trace: [ 513.590925] _raw_spin_lock+0xcc/0x160 [ 513.591119] nfs4_show_open+0x78/0x2c0 [nfsd] [ 513.591412] states_show+0x44c/0x488 [nfsd] [ 513.591681] seq_read_iter+0x5d8/0x760 [ 513.591896] seq_read+0x188/0x208 [ 513.592075] vfs_read+0x148/0x470 [ 513.592241] ksys_read+0xcc/0x178

• udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
• bpf: Prevent tail call between progs attached to different hooks {CVE-2024-50063}
• nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
• nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-46682}
• net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
• net: fix geneve_opt length integer overflow {CVE-2025-22055}
• net: usb: lan78xx: Fix double free issue with interrupt buffer allocation {CVE-2024-53213}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}

• Bluetooth: Fix use after free in hci_send_acl {CVE-2022-49111}
• drm/amd/display: clear optc underflow before turn off odm clock {CVE-2022-49969}
• NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
• NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-50072}
• tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() {CVE-2022-49940}
• net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
• udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
• mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669}
• net: introduce and use lock_sock_fast_nested() {CVE-2022-49669}
• net: add annotation for sock_{lock,unlock}_fast {CVE-2022-49669}
• net/mlx5: Always stop health timer during driver removal {CVE-2024-40906}
• nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
• nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-50106}
• nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106}
• nfsd: remove fault injection code {CVE-2024-50106}
• nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106}
• ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 {CVE-2022-49238}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• cifs: fix potential double free during failed mount {CVE-2022-49541}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() {CVE-2024-50282}

• Bluetooth: Fix use after free in hci_send_acl {CVE-2022-49111}
• NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
• NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-50072}
• net: qrtr: start MHI channel after endpoit creation {CVE-2022-50044}
• tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() {CVE-2022-49940}
• net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
• udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
• mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669}
• net: introduce and use lock_sock_fast_nested() {CVE-2022-49669}
• net: add annotation for sock_{lock,unlock}_fast {CVE-2022-49669}
• net/mlx5: Always stop health timer during driver removal {CVE-2024-40906}
• nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
• nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-50106}
• nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106}
• nfsd: remove fault injection code {CVE-2024-50106}
• nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106}
• ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 {CVE-2022-49238}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() {CVE-2024-50282}

In the Linux kernel, the following vulnerability has been resolved:

nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open

Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of sc_type") states_show() relied on sc_type field to be of valid type before calling into a subfunction to show content of a particular stateid. From that commit, we split the validity of the stateid into sc_status and no longer changed sc_type to 0 while unhashing the stateid. This resulted in kernel oopsing for nfsv4.0 opens that stay around and in nfs4_show_open() would derefence sc_file which was NULL.

Instead, for closed open stateids forgo displaying information that relies of having a valid sc_file.

To reproduce: mount the server with 4.0, read and close a file and then on the server cat /proc/fs/nfsd/clients/2/states

[ 513.590804] Call trace: [ 513.590925] _raw_spin_lock+0xcc/0x160 [ 513.591119] nfs4_show_open+0x78/0x2c0 [nfsd] [ 513.591412] states_show+0x44c/0x488 [nfsd] [ 513.591681] seq_read_iter+0x5d8/0x760 [ 513.591896] seq_read+0x188/0x208 [ 513.592075] vfs_read+0x148/0x470 [ 513.592241] ksys_read+0xcc/0x178