CVE-2026-31403 - Vulnerability Details

- NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

The /proc/fs/nfs/exports proc entry is created at module init
and persists for the module's lifetime. exports_proc_open()
captures the caller's current network namespace and stores
its svc_export_cache in seq->private, but takes no reference
on the namespace. If the namespace is subsequently torn down
(e.g. container destruction after the opener does setns() to a
different namespace), nfsd_net_exit() calls nfsd_export_shutdown()
which frees the cache. Subsequent reads on the still-open fd
dereference the freed cache_detail, walking a freed hash table.

Hold a reference on the struct net for the lifetime of the open
file descriptor. This prevents nfsd_net_exit() from running --
and thus prevents nfsd_export_shutdown() from freeing the cache
-- while any exports fd is open. cache_detail already stores
its net pointer (cd->net, set by cache_create_net()), so
exports_release() can retrieve it without additional per-file
storage.

Published: 2026-04-03

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The NFS daemon creates a /proc/fs/nfs/exports entry that records the current network namespace without retaining a reference to it. When that namespace is destroyed after the file descriptor remains open, the NFS export cache is freed. Subsequent reads through the still‑open file then dereference freed memory, causing a use‑after‑free that can crash the kernel or otherwise destabilize the system.

Affected Systems

All Linux kernel installations that load the NFSD module and expose the /proc/fs/nfs/exports entry are affected, regardless of the specific release. This includes typical builds that enable NFS server support and keep the proc entry active for the lifetime of the module.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, but the EPSS score is under 1% and the vulnerability is not listed in CISA KEV, suggesting a low exploitation probability. An attacker would need to open the /proc/fs/nfs/exports file and then trigger a teardown of the associated network namespace (a scenario that can arise in container or virtualized environments). The impact is primarily denial of service via kernel crash, with no explicit evidence of privilege escalation or code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< 76740c28050dc6db2f5550f1325b00a11bbb3255
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< c7f406fb341d6747634b8b1fa5461656e5e56076
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< d1a19217995df9c7e4118f5a2820c5032fef2945
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< e3d77f935639e6ae4b381c80464c31df998d61f4
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< 6a8d70e2ad6aad2c345a5048edcb8168036f97d6
`96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5`	affected	< e7fcf179b82d3a3730fd8615da01b087cc654d0b

Linux

affected

Version	Status	Constraints
`3.9`	affected	—
`0`	unaffected	< 3.9
`5.10.253`	unaffected	≤ 5.10.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,c7f406fb341d6747634b8b1fa5461656e5e56076)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,d1a19217995df9c7e4118f5a2820c5032fef2945)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,e3d77f935639e6ae4b381c80464c31df998d61f4)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,6a8d70e2ad6aad2c345a5048edcb8168036f97d6)`	affected	code_commit	—
`[96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5,e7fcf179b82d3a3730fd8615da01b087cc654d0b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.9`	affected	generic	—
`[0,3.9)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the NFSD patch holding a reference on the network namespace for the lifetime of the exports file descriptor.
If an update is unavailable, restrict read access to /proc/fs/nfs/exports so that only privileged processes can open it, limiting the opportunity to trigger the use‑after‑free.
Ensure that processes with access to /proc/fs/nfs/exports do not perform a namespace teardown (e.g., avoid setns() to a different namespace) while the file descriptor remains open, preventing the cache from being freed prematurely.

Generated by OpenCVE AI on October 23, 2026 at 08:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DLA	DLA-4606-1	linux security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00131.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://git.kernel.org/stable/c/6a8d70e2ad6aad2c345a5048edcb8168036f97d6
https://git.kernel.org/stable/c/76740c28050dc6db2f5550f1325b00a11bbb3255
https://git.kernel.org/stable/c/c7f406fb341d6747634b8b1fa5461656e5e56076
https://git.kernel.org/stable/c/d1a19217995df9c7e4118f5a2820c5032fef2945
https://git.kernel.org/stable/c/db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6
https://git.kernel.org/stable/c/e3d77f935639e6ae4b381c80464c31df998d61f4
https://git.kernel.org/stable/c/e7fcf179b82d3a3730fd8615da01b087cc654d0b
https://lore.kernel.org/linux-cve-announce/2026040328-CVE-2026-31403-5446@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31403
https://www.cve.org/CVERecord?id=CVE-2026-31403

History

Mon, 19 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 16 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 15 Oct 2026 02:30:00 +0000

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Wed, 20 May 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/76740c28050dc6db2f5550f1325b00a11bbb3255

Tue, 07 Apr 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026040328-CVE-2026-31403-5446@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31403 https://www.cve.org/CVERecord?id=CVE-2026-31403
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Fri, 03 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage.
Title		NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6a8d70e2ad6aad2c345a5048edcb8168036f97d6 https://git.kernel.org/stable/c/c7f406fb341d6747634b8b1fa5461656e5e56076 https://git.kernel.org/stable/c/d1a19217995df9c7e4118f5a2820c5032fef2945 https://git.kernel.org/stable/c/db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6 https://git.kernel.org/stable/c/e3d77f935639e6ae4b381c80464c31df998d61f4 https://git.kernel.org/stable/c/e7fcf179b82d3a3730fd8615da01b087cc654d0b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T15:16:06.444Z

Updated: 2026-10-19T18:35:46.952Z

Reserved: 2026-03-09T15:48:24.086Z

Link: CVE-2026-31403

Vulnrichment

Updated: 2026-10-15T01:15:45.157Z

NVD

Status : Modified

Published: 2026-04-03T16:16:39.467

Modified: 2026-10-19T19:17:51.830

Link: CVE-2026-31403

Redhat

Severity : Moderate

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-31403 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T08:30:09Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object