Messages in this thread |  | | Date | Thu, 02 Apr 2026 15:06:26 -0400 | | From | "Chuck Lever" <> | | Subject | Re: [BUG] Linux Kernel NFS Server refcount t Underflow in nf s3svc release getacl (S→C) |
| |
On Thu, Apr 2, 2026, at 7:05 AM, ven0mfuzzer wrote: > Linux Kernel NFS Server refcount_t Underflow in nfs3svc_release_getacl (S→C) > > 1. Vulnerability Title > > Linux Kernel NFS Server (nfsd) refcount_t Underflow via Malicious > GETACL Request with Corrupted File Handle
The described mechanism -- a refcount underflow from fh_put on an uninitialized handle -- cannot occur because the SunRPC layer zero-initializes the response buffer and fh_put() guards all refcount operations behind NULL checks.
-- Chuck Lever
|  |