CVE-2022-50401 in Linux
Sumário
de VulDB • 29/06/2026
Based on the kernel log provided, you are experiencing a **kernel panic/oops** caused by memory corruption in the Linux NFS server (`nfsd`) subsystem. Specifically, it is a `list_add` corruption error occurring during an asynchronous callback update process.
Here’s a breakdown of what happened and how to address it:
### 1. Root Cause Analysis * **Error Type:** `list_add corruption`. This indicates that the doubly-linked list data structure in memory has been corrupted. The kernel detected that when trying to add a new element, the `next->prev` pointer did not point back correctly to its predecessor (`prev`). * Expected: `ffff89ac4977e538` * Found: `ffff89ac4763e018` * **Triggering Function:** The crash occurred in `nfsd4_process_cb_update.isra.11`, which is part of the NFSv4 callback mechanism (`svc_xprt_put`). This function handles asynchronous callbacks from clients (e.g., for delegation recalls or lock state management). * **Context:** It was running on a kernel worker thread (`worker_thread` -> `process_one_work`), specifically handling an RPC transport reference count decrement (`svc_xprt_put`).
### 2. Likely Causes This type of corruption is rarely due to simple logic bugs in modern kernels but rather stems from: 1. **Use-After-Free (UAF):** A pointer to a list node was freed, and then another thread tried to modify or add it back into the list. The memory might have been reused for something else, leading to invalid pointers. 2. **Double Free:** Similar to UAF, if an object is freed twice, its internal list pointers may be corrupted when re-added. 3. **Race Condition in NFSv4 Callbacks:** There are known historical issues with race conditions between the callback worker thread and other parts of the NFS server (like state management or transport cleanup). If a client disconnects abruptly while callbacks are pending, it can lead to inconsistent states. 4. **Hardware/Driver Issues:** Less likely but possible: faulty RAM causing bit flips in memory structures.
### 3. Recommended Actions
#### A. Immediate Mitigation 1. **Update Kernel and NFS Utilities:** Ensure you are running the latest stable kernel version for your distribution. Many such race conditions have been patched in recent years (especially around `nfsd` callback handling). 2. **Check Client Behavior:** Look at your NFS clients. Are any of them crashing, rebooting unexpectedly, or having network issues? Abrupt client disconnections are a common trigger for these races. Consider increasing timeout values if applicable. 3. **Disable Callbacks (Temporary Workaround):** If the issue is critical and you cannot update immediately, you can try disabling NFSv4 callbacks on the server side by adding `nfsd_callback=0` to the kernel boot parameters or module options for `sunrpc`. Note: This may impact performance of certain operations like delegation recalls. * Example: Add `options sunrpc nfsd_callback=0` in `/etc/modprobe.d/` and rebuild initramfs if needed.
#### B. Debugging Steps 1. **Enable Kernel Slab Debugger:** To get more details about which object is corrupted, enable the slab debugger before reproducing the issue: ```bash echo "slub_debug=FZPU" > /sys/module/slub/parameters/debug_mask # Or via kernel boot parameter: slub_debug=FUZP ``` 2. **Check dmesg for Earlier Warnings:** Look at logs *before* the crash (e.g., `dmesg | grep -i "nfs\|rpc\|list"`). You might see earlier warnings about use-after-free or memory leaks that point to the root cause. 3. **Reproduce with Debug Symbols:** If you can reproduce it reliably, consider compiling a kernel with debug symbols (`CONFIG_DEBUG_INFO=y`) and using `crash` utility to analyze the core dump if one is generated.
#### C. Long-Term Solution 1. **Report Bug:** If this happens on an up-to-date system, report it as a bug against your distribution's kernel package (e.g., Red Hat BZ, Ubuntu LP, Debian BTS). Include: * Full `dmesg` output around the crash. * Kernel version (`uname -r`). * NFS server and client versions. * Steps to reproduce (if possible).
### Summary This is a **memory corruption bug in the Linux NFSv4 callback subsystem**. It’s likely triggered by a race condition involving asynchronous callbacks, possibly exacerbated by unstable clients or an older kernel version. Updating your system and monitoring
If you want to get best quality of vulnerability data, you may have to visit VulDB.