---
id: CVE-2024-46682
title: 'nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open

  Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of
  sc_type") states_show() relied on sc_type fi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3f29cc82a84c23cfd12b903029dd26002ca825f5 <
    ba0b697de298285301c71c258598226e06494236
  - >-
    Linux >= 3f29cc82a84c23cfd12b903029dd26002ca825f5 <
    a204501e1743d695ca2930ed25a2be9f8ced96d3
  - Linux 172d038b7c4d3cfa9fc5ac210577c5c4f8256320
  - Linux >= 6.6.160 < 6.7
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-29T15:09:15.742949Z'
published: '2024-09-13'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:35:12.132Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-46682'
references:
  - url: 'https://git.kernel.org/stable/c/ba0b697de298285301c71c258598226e06494236'
  - url: 'https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3'
tags:
  - cve.org
epss: 0.00219
epssPercentile: 0.12321
ingestedAt: '2026-10-21T12:48:53.731Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open

Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of
sc_type") states_show() relied on sc_type field to be of valid
type before calling into a subfunction to show content of a
particular stateid. From that commit, we split the validity of
the stateid into sc_status and no longer changed sc_type to 0
while unhashing the stateid. This resulted in kernel oopsing
for nfsv4.0 opens that stay around and in nfs4_show_open()
would derefence sc_file which was NULL.

Instead, for closed open stateids forgo displaying information
that relies of having a valid sc_file.

To reproduce: mount the server with 4.0, read and close
a file and then on the server cat /proc/fs/nfsd/clients/2/states

[  513.590804] Call trace:
[  513.590925]  _raw_spin_lock+0xcc/0x160
[  513.591119]  nfs4_show_open+0x78/0x2c0 [nfsd]
[  513.591412]  states_show+0x44c/0x488 [nfsd]
[  513.591681]  seq_read_iter+0x5d8/0x760
[  513.591896]  seq_read+0x188/0x208
[  513.592075]  vfs_read+0x148/0x470
[  513.592241]  ksys_read+0xcc/0x178

## Affected

- `Linux >= 3f29cc82a84c23cfd12b903029dd26002ca825f5 < ba0b697de298285301c71c258598226e06494236`
- `Linux >= 3f29cc82a84c23cfd12b903029dd26002ca825f5 < a204501e1743d695ca2930ed25a2be9f8ced96d3`
- `Linux 172d038b7c4d3cfa9fc5ac210577c5c4f8256320`
- `Linux >= 6.6.160 < 6.7`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.