CVE-2021-47259

A flaw was found in the Linux kernel's Network File System (NFS) client. A local user could exploit this vulnerability to cause a Denial of Service (DoS) through a system crash. The issue arises from a use-after-free condition—where memory is accessed after being released—in the nfs4_init_client() function when mounting multiple file system exports from the same server across different network interfaces. Improper reference counting during this process leads to memory corruption and kernel failure.

This vulnerability is rated as Low impact for Red Hat Enterprise Linux because exploitation requires privileged filesystem mount capabilities under a non-standard multihomed network configuration, and the blast radius is confined to a local denial of service. Standard Red Hat environments restrict mounting operations to administrative accounts or trusted system services, preventing unprivileged users from initiating the concurrent mount requests required to trigger the flaw. Furthermore, connecting to the same remote NFS server across separate network interfaces is an edge-case configuration that does not reflect typical enterprise client deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.