Loading vulnerability…
CVE-2024-53216 is a use-after-free flaw in the Linux kernel NFS server daemon (nfsd) export-cache handling. During the c_show and e_show paths, the final cache_head reference can be released while an RCU read-side critical section remains active. svc_export_put can then free the export object's UUID data before the show path finishes accessing it, causing a stale read in svc_export_show. The same release path can invoke path_put and dput, which may sleep and therefore must not execute inside the RCU read-side section. The upstream correction uses rcu_work to defer release of svc_expkey and svc_export objects, execute path cleanup asynchronously, and free associated UUID, export, and key data only after an RCU grace period. The issue was introduced in Linux kernel 4.20.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel vulnerability in nfsd involving release of svc_expkey/svc_export with rcu_work.
Linux kernel NFSD resource-lifetime flaw.
A Linux kernel NFS server daemon (nfsd) use-after-free and unsafe RCU-context resource-release issue involving svc_export/svc_expkey objects. It can free ex_uuid while procfs show handlers still access it, and can invoke sleeping path_put/dput operations while under an RCU read-side critical section.
A Linux kernel NFS server daemon (nfsd) use-after-free vulnerability involving svc_export/svc_expkey lifecycle handling. A local, low-privileged attacker may be able to read memory, cause a denial of service, and potentially affect confidentiality and integrity. The fix defers release through rcu_work so cleanup occurs after an RCU grace period and in a context that can safely sleep.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.