Linux NFS server (nfsd, NFSv4.0 LOCK replay cache): A denied NFSv4.0 LOCK whose conflicting owner string is large

Impact

A denied NFSv4.0 LOCK whose conflicting owner string is large writes up to 944 bytes past a fixed 112-byte replay buffer, corrupting kernel slab memory on the NFS server. Two cooperating clients trigger it with no credentials, so a tenant can crash or potentially take over the file server that all jobs mount.

Who can reach it

Two NFSv4.0 clients that can reach the server: one takes a lock with a long owner string, the other requests a conflicting lock. Explicitly unauthenticated per the upstream analysis, so any compute node with the export reachable is enough.

What to do

Update the storage server kernel to one carrying the nfsd replay-cache bounds fix and reboot it (fail over the export first if you run HA). Where no fixed kernel is available yet, force clients to NFSv4.1+ with vers=4.1 or higher, which does not use this replay cache.

References