CVE-2026-74730

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Published Aug 22, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Dan Aloni reports that he was able to hit a use-after-free bug if a
FREE_STATEID operation gets delayed for whatever reason. Fix this by
bumping the refcount of the 'struct nfs_server' object for the duration
of the FREE_STATEID so it doesn't get cleaned up from underneath us
while operations are still in flight.

Analysis

Technical impact

A use-after-free bug is triggered during an NFS FREE_STATEID operation. If the operation is delayed, the kernel may free the 'struct nfs_server' while it is still in use, allowing an attacker to manipulate memory and potentially execute arbitrary code or corrupt data. The weakness corresponds to the CWE-911 weakness.

Affected Systems

All Linux kernel implementations that have not yet applied the patch that bumps the reference count during FREE_STATEID are affected. The CVE does not specify particular kernel releases, so any installation running the unpatched kernel on a system that exposes NFS services is at risk.

Risk and Exploitability

The CVSS score is 9.8, EPSS is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector would involve an attacker with access to trigger a delayed FREE_STATEID, such as a privileged NFS client or administrator. Exploitation could lead to arbitrary code execution or system compromise, but the low exploitation probability indicates the risk is moderate but not negligible.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< ed2f92ce2fc48463c41e0e540b9a3454889e8af8
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< d858ab09e787106432d4d9830bad9dfedf02f890
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< af62f1af182d33a0de38308c012841885d8ab92e
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< ed1161ab6239761958b38d5667225634fc2be894
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< d71dfffa512e71b166a889484e4c3b148a9a3af2
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< cf616096a0f3a2b60f7d68b6b39674a6867ded9c

Linux

affected

Version	Status	Constraints
`3.10`	affected	—
`0`	unaffected	< 3.10
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,ed2f92ce2fc48463c41e0e540b9a3454889e8af8)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,d858ab09e787106432d4d9830bad9dfedf02f890)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,af62f1af182d33a0de38308c012841885d8ab92e)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,ed1161ab6239761958b38d5667225634fc2be894)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,d71dfffa512e71b166a889484e4c3b148a9a3af2)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,80ed3d762628b36c9e4b22fac7c65b72ef3b13dd)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,cf616096a0f3a2b60f7d68b6b39674a6867ded9c)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.10`	affected	generic	—
`[0,3.10)`	unaffected	generic	—
`[0,5.11.0)`	unaffected	semver	—
`[0,5.16.0)`	unaffected	semver	—
`[0,6.2.0)`	unaffected	semver	—
`[0,6.7.0)`	unaffected	semver	—
`[0,6.13.0)`	unaffected	semver	—
`[0,6.19.0)`	unaffected	semver	—
`[0,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the patch to bump the reference count of the nfs_server during FREE_STATEID
Restart the NFS service after updating the kernel to ensure the new reference counting is active
Until a patch is available, restrict or disable NFS services from untrusted clients to reduce exposure

Generated by OpenCVE AI on August 25, 2026 at 07:51 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.510% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd
https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e
https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd
https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c
https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2
https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890
https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894
https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8
https://lore.kernel.org/linux-cve-announce/2026082242-CVE-2026-74730-e35d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74730
https://www.cve.org/CVERecord?id=CVE-2026-74730

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 24, 2026 2:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Aug 24, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082242-CVE-2026-74730-e35d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74730 https://www.cve.org/CVERecord?id=CVE-2026-74730
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Aug 22, 2026 6:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
Title		NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2 https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890 https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894 https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8