lkml.org 
[lkml]   [2026]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [BUG] Linux Kernel NFS Server refcount t Underflow in nf s3svc release getacl (S→C)

On Thu, Apr 2, 2026, at 7:05 AM, ven0mfuzzer wrote:
> Linux Kernel NFS Server refcount_t Underflow in nfs3svc_release_getacl (S→C)
>
> 1. Vulnerability Title
>
> Linux Kernel NFS Server (nfsd) refcount_t Underflow via Malicious
> GETACL Request with Corrupted File Handle

The described mechanism -- a refcount underflow from fh_put on an
uninitialized handle -- cannot occur because the SunRPC layer
zero-initializes the response buffer and fh_put() guards all
refcount operations behind NULL checks.


--
Chuck Lever

\
 
 \ /
  Last update: 2026-04-02 21:07    [W:0.055 / U:14.050 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog