LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26958: nfs: fix UAF in direct writes

In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race in Linux NFS direct-write handling can finish the same request twice, underflow its reference count, and access freed memory. On affected systems using NFS direct writes, this could destabilize the kernel and potentially affect confidentiality, integrity, or availability. The evidence shows repeatable warnings under heavy stress, not confirmed compromise.

Executive priority

Treat this as high priority for NFS-intensive Linux fleets and multi-user hosts, but below remotely exploitable or confirmed-active threats. Use expedited kernel maintenance. Request an inventory of affected running builds, ownership for required reboots, and confirmation that NFS direct-write workloads remain stable afterward.

Technical view

During asynchronous NFS commit submission, one commit may complete before the next is queued. nfs_commit_end() can then cause nfs_direct_write_complete() to run twice for the same nfs_direct_request, producing reference-count underflow and use-after-free. The stable fixes add nfs_commit_begin()/nfs_commit_end() lifetime bracketing around commit processing.

Likely exposure

Exposure is most likely on Linux hosts running an affected, unpatched kernel and performing direct writes over NFS. The CVSS vector requires local, low-privileged access and no user interaction. The bundle’s version list does not clearly distinguish all introduced and fixed boundaries, so assess exact distribution builds against vendor advisories and stable commits.

Exploitation context

The bundle reports CVSS 7.8 and marks KEV false. It provides no evidence of public exploitation or active attacks. A 200-node RocksDB stress workload reportedly triggered the warning about every ten minutes before the fix. This demonstrates reliable fault triggering under load, not weaponized exploitation.

Researcher notes

The key invariant is single completion of each nfs_direct_request across asynchronous commit callbacks. The fix adds commit begin/end lifetime bracketing around nfs_generic_commit_list(). No CWE or exploit artifact is supplied. Version metadata appears flattened; determine exposure through commit containment or vendor backport status rather than treating every listed version as a definitive boundary.

Mitigation direction

  • Apply a vendor-supported kernel update containing the applicable linked stable fix.
  • Reboot affected hosts into the updated kernel and verify the running build.
  • Prioritize NFS direct-write hosts, especially shared systems with untrusted local users.
  • If patching is delayed, check vendor guidance; the source bundle names no interim workaround.

Validation and detection

  • Map each running distribution kernel build to its vendor advisory and the linked stable fix.
  • Confirm the updated kernel is active after reboot, not merely installed.
  • Review kernel logs for reference-count underflow, use-after-free, or nfs_direct_write_schedule_work warnings.
  • In non-production, repeat representative NFS direct-write stress and confirm the warning does not recur.
  • Do not rely solely on version strings because distributions may backport fixes.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26958 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-26958Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxaf7cf057933f01dc7f33ddfb5e436ad598ed17ad, af7cf057933f01dc7f33ddfb5e436ad598ed17ad, af7cf057933f01dc7f33ddfb5e436ad598ed17ad, af7cf057933f01dc7f33ddfb5e436ad598ed17ad, af7cf057933f01dc7f33ddfb5e436ad598ed17ad, af7cf057933f01dc7f33ddfb5e436ad598ed17ad, af7cf057933f01dc7f33ddfb5e436ad598ed17ad, af7cf057933f01dc7f33ddfb5e436ad598ed17adunaffected
LinuxLinux4.5, 0, 5.4.297, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.