CVE-2026-31403 - Vulnerability Details

- NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

The /proc/fs/nfs/exports proc entry is created at module init
and persists for the module's lifetime. exports_proc_open()
captures the caller's current network namespace and stores
its svc_export_cache in seq->private, but takes no reference
on the namespace. If the namespace is subsequently torn down
(e.g. container destruction after the opener does setns() to a
different namespace), nfsd_net_exit() calls nfsd_export_shutdown()
which frees the cache. Subsequent reads on the still-open fd
dereference the freed cache_detail, walking a freed hash table.

Hold a reference on the struct net for the lifetime of the open
file descriptor. This prevents nfsd_net_exit() from running --
and thus prevents nfsd_export_shutdown() from freeing the cache
-- while any exports fd is open. cache_detail already stores
its net pointer (cd->net, set by cache_create_net()), so
exports_release() can retrieve it without additional per-file
storage.

Published: 2026-04-03

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The NFS daemon creates a /proc/fs/nfs/exports entry that stores the current network namespace without taking a reference on it; when the namespace is torn down after the file descriptor is open, the export cache is freed. Subsequent reads on the open descriptor then dereference freed memory, which can crash the kernel or destabilize the system.

Affected Systems

All Linux systems that compile and load the NFSD module are affected. The vulnerability is present in any kernel that keeps the /proc/fs/nfs/exports entry active for the lifetime of the module, irrespective of the kernel release, so users should verify whether their running kernel contains this module and the vulnerable code path.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, but the EPSS score is below 1% and the vulnerability is not in the CISA KEV catalog, which lowers the likelihood of exploitation. If an attacker can open the /proc/fs/nfs/exports file and then alter or destroy the network namespace (a scenario that can occur in container or virtualized environments), the use‑after‑free could be triggered. The impact is primarily a denial of service, although the description does not explicitly state arbitrary code execution. Therefore the risk is moderate, largely dependent on the local access and namespace manipulation capabilities of the threat actor.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< 76740c28050dc6db2f5550f1325b00a11bbb3255
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< c7f406fb341d6747634b8b1fa5461656e5e56076
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< d1a19217995df9c7e4118f5a2820c5032fef2945
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< e3d77f935639e6ae4b381c80464c31df998d61f4
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< 6a8d70e2ad6aad2c345a5048edcb8168036f97d6
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< e7fcf179b82d3a3730fd8615da01b087cc654d0b

Linux

affected

Version	Status	Constraints
`3.9`	affected	—
`0`	unaffected	< 3.9
`5.10.253`	unaffected	≤ 5.10.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,c7f406fb341d6747634b8b1fa5461656e5e56076)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,d1a19217995df9c7e4118f5a2820c5032fef2945)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,e3d77f935639e6ae4b381c80464c31df998d61f4)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,6a8d70e2ad6aad2c345a5048edcb8168036f97d6)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,e7fcf179b82d3a3730fd8615da01b087cc654d0b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.9`	affected	generic	—
`[0,3.9)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel update that contains the NFSD patch to hold a reference on the network namespace for the lifetime of the exports file descriptor.
Ensure that any processes that open /proc/fs/nfs/exports do not perform a namespace teardown (e.g., avoid setns() to a new namespace) while the file descriptor remains open, reducing the chance of the cache being freed prematurely.
Change the permissions or ownership of the /proc/fs/nfs/exports file to restrict read access to privileged users, limiting the ability of an attacker to trigger the use‑after‑free when the namespace is torn down.

Generated by OpenCVE AI on April 28, 2026 at 16:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/6a8d70e2ad6aad2c345a5048edcb8168036f97d6
https://git.kernel.org/stable/c/76740c28050dc6db2f5550f1325b00a11bbb3255
https://git.kernel.org/stable/c/c7f406fb341d6747634b8b1fa5461656e5e56076
https://git.kernel.org/stable/c/d1a19217995df9c7e4118f5a2820c5032fef2945
https://git.kernel.org/stable/c/db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6
https://git.kernel.org/stable/c/e3d77f935639e6ae4b381c80464c31df998d61f4
https://git.kernel.org/stable/c/e7fcf179b82d3a3730fd8615da01b087cc654d0b
https://lore.kernel.org/linux-cve-announce/2026040328-CVE-2026-31403-5446@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31403
https://www.cve.org/CVERecord?id=CVE-2026-31403

History

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/76740c28050dc6db2f5550f1325b00a11bbb3255

Tue, 07 Apr 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026040328-CVE-2026-31403-5446@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31403 https://www.cve.org/CVERecord?id=CVE-2026-31403
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Fri, 03 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage.
Title		NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6a8d70e2ad6aad2c345a5048edcb8168036f97d6 https://git.kernel.org/stable/c/c7f406fb341d6747634b8b1fa5461656e5e56076 https://git.kernel.org/stable/c/d1a19217995df9c7e4118f5a2820c5032fef2945 https://git.kernel.org/stable/c/db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6 https://git.kernel.org/stable/c/e3d77f935639e6ae4b381c80464c31df998d61f4 https://git.kernel.org/stable/c/e7fcf179b82d3a3730fd8615da01b087cc654d0b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T15:16:06.444Z

Updated: 2026-04-27T14:02:50.491Z

Reserved: 2026-03-09T15:48:24.086Z

Link: CVE-2026-31403

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-03T16:16:39.467

Modified: 2026-04-27T14:16:36.280

Link: CVE-2026-31403

Redhat

Severity : Moderate

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-31403 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T16:45:06Z

Weaknesses

CWE-825

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object