CVE-2026-31404

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Defer sub-object cleanup in export put callbacks

svc_export_put() calls path_put() and auth_domain_put() immediately

when the last reference drops, before the RCU grace period. RCU

readers in e_show() and c_show() access both ex_path (via

seq_path/d_path) and ex_client->name (via seq_escape) without

holding a reference. If cache_clean removes the entry and drops the

last reference concurrently, the sub-objects are freed while still

in use, producing a NULL pointer dereference in d_path.

Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or

ex_stats") moved kfree of ex_uuid and ex_stats into the

call_rcu callback, but left path_put() and auth_domain_put() running

before the grace period because both may sleep and call_rcu

callbacks execute in softirq context.

Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the

callback until after the RCU grace period and executes it in process

context where sleeping is permitted. This allows path_put() and

auth_domain_put() to be moved into the deferred callback alongside

the other resource releases. Apply the same fix to expkey_put(),

which has the identical pattern with ek_path and ek_client.

A dedicated workqueue scopes the shutdown drain to only NFSD

export release work items; flushing the shared

system_unbound_wq would stall on unrelated work from other

subsystems. nfsd_export_shutdown() uses rcu_barrier() followed

by flush_workqueue() to ensure all deferred release callbacks

complete before the export caches are destroyed.

Reviwed-by: Jeff Layton <[email protected]>