Daily update · Aug 4–5, 2026
NFS FREE_STATEID use-after-free, vhost-scsi hardening, and IMA appraise fixes land
Today's mainline pulls in a pinned nfs_server lifetime fix for delayed FREE_STATEID, several vhost/vdpa robustness patches, and IMA integrity fixes for truncation and malformed xattrs.
In brief
A batch of mainline commits hardens NFSv4 stateid handling, fixes robust futex exit races, tightens vhost/vdpa memory mapping paths, validates vhost-scsi protection scatterlists, and corrects IMA appraisal behavior around truncation and malformed security xattrs. The changes are predominantly bug fixes targeting stability and security edge cases rather than new features.
NFS
Pin nfs_server during FREE_STATEID to prevent use-after-free
A delayed FREE_STATEID operation could race with server teardown and trigger a use-after-free of struct nfs_server. The fix bumps the server refcount for the duration of the asynchronous RPC.
Why it matters: Improves stability of NFSv4 mounts under delayed or slow stateid operations.
Fix refcount leak on nfs_free_stateid_data allocation failure
If allocation of nfs_free_stateid_data failed, the function exited early leaving both client and server refcounts bumped. A common exit path now cleans up dangling references.
Why it matters: Prevents reference count leaks in the FREE_STATEID error path.
Fix NULL pointer dereference in NFSv4.2 listxattr size accounting
Calling listxattr() with a buffer size of 0 (to query needed size) caused a NULL pointer dereference in _copy_from_pages on NFSv4.2 mounts due to incorrect size accounting in nfs4_listxattr.
Why it matters: Prevents a kernel oops when querying extended attribute list sizes on NFSv4.2.
Synchronization primitives
Further prevent robust futex exit race
Robust futex unlock wipes FUTEX_WAITERS and wakes one waiter; if that waiter is killed before re-arming or acquiring, the kernel must wake the next task. A prior partial fix was insufficient when a third task re-acquired the futex through the uncontended fast path.
Why it matters: Reduces the risk of hung robust futex users when woken waiters die before processing.
vhost and vdpa
Bound vhost IOTLB map allocation in add_range
Non-retiring IOTLB tables could keep allocating entries past their configured limit. The fix uses the caller-provided limit at allocation and rejects non-positive values in vhost paths that can report errors.
Why it matters: Prevents unbounded IOTLB entry growth for vhost devices.
Reject overflowing PA map page counts on 32-bit vhost/vdpa
On 32-bit systems, adding the IOVA page offset to a user-controlled map size could overflow unsigned long, causing fewer pages to be pinned and mapped than requested. Overflowing sizes are now rejected.
Why it matters: Prevents incomplete mappings and potential memory corruption on 32-bit vhost/vdpa setups.
Fix buffer length in mlx5_vdpa create_direct_keys()
create_direct_keys() computed in/out buffer lengths that could read 16 bytes beyond a 4384-byte allocation, triggering a KASAN slab-out-of-bounds report. The length calculation is corrected.
Why it matters: Fixes an out-of-bounds read in mlx5_vdpa direct key creation seen in CI.
Validate T10 PI scatterlist counts in vhost-scsi
A malformed request could claim protection bytes covering or exceeding the payload, leaving a zero data SGL count that triggered BUG_ON(!nents) in sg_alloc_table_chained(). Protection lengths are now validated before iterator advancement.
Why it matters: Prevents a kernel BUG from malformed T10 PI requests in vhost-scsi.
Reset vring metadata cache on vring reconfiguration
VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM could replace or resize vring regions without invalidating the meta_iotlb cache, causing iotlb_access_ok() to trust stale mappings. The cache is now reset on these ioctls.
Why it matters: Prevents stale IOTLB metadata from bypassing validation during live vring reconfiguration.
Flush vhost-scsi backend after device ioctls
VHOST_SET_MEM_TABLE could replace the memory table while in-flight commands still held response iovecs translated through the old table, risking writes to unrelated userspace objects. The backend is now flushed after vhost_dev_ioctl() handles device ioctls.
Why it matters: Prevents response completion from writing to stale or unrelated userspace memory in vhost-scsi.
Reject vhost-scsi feature changes after endpoint setup
Enabling VIRTIO_SCSI_F_T10_PI after VHOST_SCSI_SET_ENDPOINT left prot_sgl NULL while the I/O path followed the new feature bit, causing a NULL pointer passed to sg_alloc_table_chained(). Feature changes after endpoint are now rejected.
Why it matters: Prevents a NULL scatterlist crash from late T10 PI feature toggling in vhost-scsi.
Integrity Measurement Architecture (IMA)
Fix out-of-bounds read in xattr_verify()
A digest-length check mixed int and size_t arithmetic, causing a truncated xattr to underflow to SIZE_MAX and pass the check, after which memcmp() read past the end of the allocated buffer. The comparison is corrected.
Why it matters: Prevents an out-of-bounds read when appraising files with malformed IMA xattrs.
Instantiate file_truncate and path_truncate hooks
New LSM hooks reset IMA action cache flags on truncation requests, so the file is re-collected, re-measured, re-audited, and re-appraised on next access according to policy.
Why it matters: Ensures IMA re-evaluates files after truncation, maintaining accurate integrity state.
Source commits13 entries +
vhost_iotlb: bound map allocation in add_range
Linfeng Sun · Jun 20, 2026 · 8 files
vhost/vdpa: reject overflowing PA map page counts on 32-bit
Yousef Alhouseen · Jun 24, 2026 · 1 files
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Anna Schumaker · Jun 30, 2026 · 1 files
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails
Anna Schumaker · Jun 30, 2026 · 1 files
vdpa/mlx5: Fix buffer length in create_direct_keys()
Christian Borntraeger · Jul 6, 2026 · 1 files
NFSv4.2: fix nfs4_listxattr size accounting
Achilles Gaikwad · Jul 7, 2026 · 1 files
futex: Prevent robust futex exit race some more
Keno Fischer · Jul 21, 2026 · 1 files
vhost-scsi: flush backend after device ioctls
Jia Jia · Jul 24, 2026 · 1 files
vhost-scsi: reject feature changes after endpoint
Jia Jia · Jul 26, 2026 · 1 files
vhost-scsi: Validate T10 PI scatterlist counts
Linfeng Sun · Jul 27, 2026 · 1 files
ima: Instantiate file_truncate and path_truncate hooks
Mimi Zohar · Jul 28, 2026 · 1 files
vhost: reset the vring metadata cache on vring reconfiguration
Jun Yang · Aug 3, 2026 · 1 files
ima: fix out-of-bounds read in xattr_verify()
Lincoln Wallace · Aug 3, 2026 · 1 files