CVE-2007-6733 in Linux
Summary
by MITRE
The nfs_lock function in fs/nfs/file.c in the Linux kernel 2.6.9 does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on an NFS filesystem and then changing this file's permissions, a related issue to CVE-2010-0727.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/02/2026
The vulnerability described in CVE-2007-6733 represents a critical flaw in the Linux kernel's Network File System implementation that specifically affects the nfs_lock function within the fs/nfs/file.c source file. This issue manifests when dealing with files that possess the setgid bit but lack group execute permission, creating a dangerous condition where the kernel fails to properly clean up POSIX lock structures. The flaw stems from an improper handling of lock removal operations during file permission changes, which can lead to kernel memory corruption and subsequent system instability. The vulnerability operates at the intersection of file system security mechanisms and kernel locking primitives, creating a scenario where legitimate system operations can trigger catastrophic failures.
The technical root cause of this vulnerability lies in the kernel's failure to properly synchronize lock state management with file permission changes in NFS environments. When a file with setgid bit is locked and subsequently has its permissions modified, particularly when group execute permission is removed, the nfs_lock function does not correctly invalidate or remove the existing lock structures from kernel memory. This creates a dangling reference condition where the kernel maintains lock information for files that no longer exist in the expected state. The flaw is particularly insidious because it operates silently until triggered by specific permission changes, making it difficult to detect during normal system operation and allowing malicious users to exploit it for denial of service attacks.
The operational impact of CVE-2007-6733 extends beyond simple service disruption to potentially causing complete system crashes and BUG messages within the Linux kernel. Local attackers with access to the affected NFS filesystem can exploit this vulnerability by first establishing a POSIX lock on a setgid file, then modifying the file's permissions to remove group execute rights. This sequence of operations forces the kernel into an inconsistent state where memory corruption occurs, leading to kernel panics and system reboots. The vulnerability affects systems running Linux kernel versions 2.6.9 and earlier, representing a significant risk to enterprise environments that rely heavily on NFS file sharing and have users with local access to these resources. The related nature to CVE-2010-0727 indicates this represents a broader class of issues affecting NFS lock handling in kernel versions.
From a cybersecurity perspective, this vulnerability aligns with CWE-129 and CWE-128 categories related to improper handling of resources and buffer overruns in kernel space operations. The attack vector operates through local privilege escalation paths where attackers can leverage their access to NFS shares to execute the triggering sequence. This vulnerability also maps to ATT&CK technique T1059.007 for command and script interpreter execution, as attackers may use legitimate system tools to manipulate file permissions and trigger the kernel bug. The remediation approach requires kernel version updates to patched versions that properly handle lock state transitions during permission changes, along with proper NFS client configuration to minimize exposure. Organizations should implement monitoring for abnormal NFS lock behavior and consider restricting setgid permissions on NFS-mounted filesystems where possible to reduce attack surface.
The broader implications of this vulnerability highlight the complexity of kernel-level security in distributed file systems where multiple access control mechanisms must interoperate correctly. The issue demonstrates how seemingly minor permission bits like setgid can create cascading failures when combined with locking mechanisms and improper resource cleanup. System administrators should prioritize kernel updates as part of their vulnerability management programs, particularly in environments where NFS is extensively used. The vulnerability also underscores the importance of proper input validation and resource management in kernel space code, as the failure to properly handle file permission changes can have catastrophic consequences for system stability and availability.