The Linux kernel's NFS server (nfsd) had a vulnerability triggered when CONFIG_NFSD_V4_2_INTER_SSC is enabled. Specifically, nfsd4_putfh() could return success with both fh_dentry and fh_export as NULL if fh_verify() returned nfserr_stale and putfh->no_verify was true. The NFSD4_FH_FOREIGN flag was set, but the compound dispatch loop did not prevent subsequent operations from running with a NULL fh_dentry, causing a NULL pointer dereference. A remote client could exploit this by crafting a COMPOUND request with an inter-SSC COPY operation and an additional operation inserted between the source PUTFH and SAVEFH, such as SETATTR, which dereferences a NULL pointer. The patch gates the dispatch loop to allow only OP_SAVEFH and operations allowed without a filehandle to proceed when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, returning nfserr_stale for all others, consistent with RFC 7862 Section 15.2.3.

A remote client can cause a NULL pointer dereference in the nfsd kernel thread, potentially leading to a denial of service (kernel crash) on the affected system. There is no information about code execution or data corruption. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to restrict operations allowed after a FOREIGN PUTFH with a NULL filehandle, preventing the NULL pointer dereference. Users should apply the official kernel update that includes this patch. Patch status is not explicitly stated in the provided data; check the vendor or Linux kernel advisory for the exact fixed versions and update instructions.