CVE-2026-31404 - Vulnerability Details

- NFSD: Defer sub-object cleanup in export put callbacks

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Defer sub-object cleanup in export put callbacks

svc_export_put() calls path_put() and auth_domain_put() immediately
when the last reference drops, before the RCU grace period. RCU
readers in e_show() and c_show() access both ex_path (via
seq_path/d_path) and ex_client->name (via seq_escape) without
holding a reference. If cache_clean removes the entry and drops the
last reference concurrently, the sub-objects are freed while still
in use, producing a NULL pointer dereference in d_path.

Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or
ex_stats") moved kfree of ex_uuid and ex_stats into the
call_rcu callback, but left path_put() and auth_domain_put() running
before the grace period because both may sleep and call_rcu
callbacks execute in softirq context.

Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the
callback until after the RCU grace period and executes it in process
context where sleeping is permitted. This allows path_put() and
auth_domain_put() to be moved into the deferred callback alongside
the other resource releases. Apply the same fix to expkey_put(),
which has the identical pattern with ek_path and ek_client.

A dedicated workqueue scopes the shutdown drain to only NFSD
export release work items; flushing the shared
system_unbound_wq would stall on unrelated work from other
subsystems. nfsd_export_shutdown() uses rcu_barrier() followed
by flush_workqueue() to ensure all deferred release callbacks
complete before the export caches are destroyed.

Reviwed-by: Jeff Layton <jlayton@kernel.org>

Published: 2026-04-03

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux NFS server causes a use‑after‑free when export objects are released prematurely. Clean‑up functions free the path and client name before the RCU grace period ends, so an RCU reader that accesses these objects can dereference a NULL pointer and trigger a kernel panic. The crash disrupts all kernel operations, effectively denying service to the host.

Affected Systems

All Linux kernels that include the NFS daemon but have not incorporated commit 2530766492ec are vulnerable. Exact version boundaries are not listed, so any kernel built before this commit—across mainstream distributions and custom builds—may be affected. Systems that never run the nfsd service are not susceptible.

Risk and Exploitability

The CVSS score of 7.8 reflects high severity, while the EPSS score is below 1 %, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must first obtain code execution at kernel level or leverage a privileged NFS operation to trigger the affected code path; the result is a denial‑of‑service rather than arbitrary code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c224edca7af028828e2ad866b61d731b5e72b46d`	affected	< 2829e80d29b627886d12b5ea40856d56b516e67d
`c224edca7af028828e2ad866b61d731b5e72b46d`	affected	< f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2
`c224edca7af028828e2ad866b61d731b5e72b46d`	affected	< 48db892356d6cb80f6942885545de4a6dd8d2a29

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c224edca7af028828e2ad866b61d731b5e72b46d,2829e80d29b627886d12b5ea40856d56b516e67d)`	affected	code_commit	—
`[c224edca7af028828e2ad866b61d731b5e72b46d,f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2)`	affected	code_commit	—
`[c224edca7af028828e2ad866b61d731b5e72b46d,48db892356d6cb80f6942885545de4a6dd8d2a29)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.14`	affected	semver	—
`[0,6.14)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes commit 2530766492ec to defer NFSD export cleanup until after the RCU grace period
If a kernel upgrade cannot be performed immediately, disable or restrict access to the NFS service until the patch is available
Monitor kernel logs for crashes or denial‑of‑service incidents and verify that high‑availability or failover mechanisms can maintain service continuity

Generated by OpenCVE AI on April 28, 2026 at 08:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d
https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29
https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2
https://lore.kernel.org/linux-cve-announce/2026040328-CVE-2026-31404-f58a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31404
https://www.cve.org/CVERecord?id=CVE-2026-31404

History

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 07 Apr 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026040328-CVE-2026-31404-f58a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31404 https://www.cve.org/CVERecord?id=CVE-2026-31404
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 03 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer sub-object cleanup in export put callbacks svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. If cache_clean removes the entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path. Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or ex_stats") moved kfree of ex_uuid and ex_stats into the call_rcu callback, but left path_put() and auth_domain_put() running before the grace period because both may sleep and call_rcu callbacks execute in softirq context. Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the callback until after the RCU grace period and executes it in process context where sleeping is permitted. This allows path_put() and auth_domain_put() to be moved into the deferred callback alongside the other resource releases. Apply the same fix to expkey_put(), which has the identical pattern with ek_path and ek_client. A dedicated workqueue scopes the shutdown drain to only NFSD export release work items; flushing the shared system_unbound_wq would stall on unrelated work from other subsystems. nfsd_export_shutdown() uses rcu_barrier() followed by flush_workqueue() to ensure all deferred release callbacks complete before the export caches are destroyed. Reviwed-by: Jeff Layton <jlayton@kernel.org>
Title		NFSD: Defer sub-object cleanup in export put callbacks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29 https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T15:16:07.207Z

Updated: 2026-04-27T14:02:51.403Z

Reserved: 2026-03-09T15:48:24.086Z

Link: CVE-2026-31404

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-03T16:16:39.643

Modified: 2026-04-27T14:16:36.407

Link: CVE-2026-31404

Redhat

Severity : Moderate

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-31404 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T09:00:06Z

Weaknesses

CWE-364

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object