CVE-2023-53711

A logic error was found in the Linux kernel's NFS client implementation in the write request retransmission handling for O_DIRECT operations. A local user performing direct I/O writes over NFS can trigger this issue when the server completes writes synchronously and network conditions require retransmission, causing subrequests to not be properly rejoined to the head request before retransmit. This results in data corruption where written data may not be correctly persisted to the server.

NFS write operations can be split into multiple subrequests, which must be rejoined to the head request before any retransmission occurs. When an NFS server handles a write synchronously rather than through the commit mechanism, the head request bypasses the normal commit list path. If retransmission becomes necessary due to network issues, the code failed to add the head back to the retransmission list, leaving subrequests orphaned. This causes incomplete or corrupted writes to the server without returning errors to the application. Triggering the bug requires local access to an NFS-mounted filesystem using O_DIRECT, combined with server-side synchronous write behavior and network conditions that prompt retransmission.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using O_DIRECT for writes on NFS mounts until updates are applied. Alternatively, prevent the nfs module from being loaded if NFS is not required. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.