Re: [BUG] Linux Kernel NFS Server refcount_t Underflow in nfs3svc_release_getacl (S→C)

[Chuck Lever]

On Thu, Apr 2, 2026, at 7:05 AM, ven0mfuzzer wrote:
> Linux Kernel NFS Server refcount_t Underflow in nfs3svc_release_getacl (S→C)
>
>   1. Vulnerability Title
>
> Linux Kernel NFS Server (nfsd) refcount_t Underflow via Malicious 
> GETACL Request with Corrupted File Handle

The described mechanism -- a refcount underflow from fh_put on an
uninitialized handle -- cannot occur because the SunRPC layer
zero-initializes the response buffer and fh_put() guards all
refcount operations behind NULL checks.


-- 
Chuck Lever