by Kastro
Paper/Archive/CVE-2026-74730

CVE-2026-74730

Linux Linux — NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.5.435 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

Affected

ProductAffectedFixed inSource
Linux7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 – < ed2f92ce2fc48463c41e0e540b9a3454889e8af8ed2f92ce2fc48463c41e0e540b9a3454889e8af8CNA
Linux7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 – < d858ab09e787106432d4d9830bad9dfedf02f890d858ab09e787106432d4d9830bad9dfedf02f890CNA
Linux7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 – < af62f1af182d33a0de38308c012841885d8ab92eaf62f1af182d33a0de38308c012841885d8ab92eCNA
Linux7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 – < caee6a68ffaa5016dfc01cd0b3dc1896a32e3abdcaee6a68ffaa5016dfc01cd0b3dc1896a32e3abdCNA
Linux7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 – < ed1161ab6239761958b38d5667225634fc2be894ed1161ab6239761958b38d5667225634fc2be894CNA
Linux7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 – < d71dfffa512e71b166a889484e4c3b148a9a3af2d71dfffa512e71b166a889484e4c3b148a9a3af2CNA
Linux7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 – < 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd80ed3d762628b36c9e4b22fac7c65b72ef3b13ddCNA
Linux7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 – < cf616096a0f3a2b60f7d68b6b39674a6867ded9ccf616096a0f3a2b60f7d68b6b39674a6867ded9cCNA
Linux3.10–CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgit.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8refgit.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890refgit.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92erefgit.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abdrefgit.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894refgit.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2refgit.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13ddrefgit.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c