CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved:

nfsd: RCU-protect clcbsession to fix use-after-free on session teardown

After a DESTROY_SESSION the per-session teardown path can free a

session while rpciod still holds an inflight callback rpc_task that

dereferences clp->clcbsession.  nfsd4probecallback_sync() flushes

clcallbackwq, but once nfsd4runcb_work() has called

rpccallasync() the rpc_task lives on rpciod; flushing the workqueue

does not wait for it.  rpcshutdownclient() does drain rpciod tasks,

but uses a 1-second waiteventtimeout — tasks stuck in rpc_delay()

(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.

    destroy path                       rpciod

    ------------                       ------

    unhash_session(ses)

    nfsd4probecallback_sync(clp)

      flushworkqueue(clcallback_wq)

      / returns; rpc_task still live /

    nfsd4putsession_locked(ses)

    free_session(ses) -> kfree(ses)

                                       nfsd4cbsequence_done()

                                         reads cbclp->clcb_session

                                         / freed slab /

A second window exists in nfsd4processcb_update().  When

_nfsd4findbackchannel() returns NULL because unhashsession() has

already removed the destroyed session from cl_sessions,

setupcallbackclient() takes the v4.1 early return so

clp->clcbsession = ses never fires and the field retains a pointer

to the about-to-be-freed session.

Fix both by converting clcbsession to an RCU-protected pointer:

• Move the clcbsession = ses assignment in setupcallbackclient()

    to after rpc_create() succeeds, so it is only published when a

    working backchannel exists.  Clear clcbsession on the error

    return in nfsd4processcb_update().  Both stores use

    rcuassignpointer().

• Annotate clcbsession with __rcu.  All rpciod-side readers use

    rcureadlock()/rcu_dereference() and check for NULL, bailing to

    the appropriate error or requeue path:

    encodecbsequence4args(), decodecbsequence4resok(),

    nfsd41cbgetslot(), nfsd41cbreleaseslot(),

    nfsd4cbprepare(), and nfsd4cbsequence_done().

• Switch _freesession() from kfree() to kfree_rcu() so the

    session slab is not reclaimed until after an RCU grace period,

    guaranteeing that rpciod readers inside rcureadlock() never

    dereference freed memory.

• Pass the session pointer to the nfsdcbseq_status and

    nfsdcbfree_slot tracepoints instead of having them re-read

    clcbsession.

• nfsd4cbprepare() calls rpc_exit() when the session is NULL,

    routing through the done/release path to requeue the callback.