CVE-2026-74730 - Vulnerability Details

- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Dan Aloni reports that he was able to hit a use-after-free bug if a
FREE_STATEID operation gets delayed for whatever reason. Fix this by
bumping the refcount of the 'struct nfs_server' object for the duration
of the FREE_STATEID so it doesn't get cleaned up from underneath us
while operations are still in flight.

Published: 2026-08-22

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use-after-free bug is triggered during an NFS FREE_STATEID operation. If the operation is delayed, the kernel may free the 'struct nfs_server' while it is still in use, allowing an attacker to manipulate memory and potentially execute arbitrary code or corrupt data. The weakness corresponds to the CWE-911 weakness.

Affected Systems

All Linux kernel implementations that have not yet applied the patch that bumps the reference count during FREE_STATEID are affected. The CVE does not specify particular kernel releases, so any installation running the unpatched kernel on a system that exposes NFS services is at risk.

Risk and Exploitability

The CVSS score is 9.8, EPSS is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector would involve an attacker with access to trigger a delayed FREE_STATEID, such as a privileged NFS client or administrator. Exploitation could lead to arbitrary code execution or system compromise, but the low exploitation probability indicates the risk is moderate but not negligible.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< ed2f92ce2fc48463c41e0e540b9a3454889e8af8
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< d858ab09e787106432d4d9830bad9dfedf02f890
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< af62f1af182d33a0de38308c012841885d8ab92e
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< ed1161ab6239761958b38d5667225634fc2be894
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< d71dfffa512e71b166a889484e4c3b148a9a3af2
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd
`7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009`	affected	< cf616096a0f3a2b60f7d68b6b39674a6867ded9c

Linux

affected

Version	Status	Constraints
`3.10`	affected	—
`0`	unaffected	< 3.10
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,ed2f92ce2fc48463c41e0e540b9a3454889e8af8)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,d858ab09e787106432d4d9830bad9dfedf02f890)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,af62f1af182d33a0de38308c012841885d8ab92e)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,ed1161ab6239761958b38d5667225634fc2be894)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,d71dfffa512e71b166a889484e4c3b148a9a3af2)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,80ed3d762628b36c9e4b22fac7c65b72ef3b13dd)`	affected	code_commit	—
`[7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009,cf616096a0f3a2b60f7d68b6b39674a6867ded9c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.10`	affected	generic	—
`[0,3.10)`	unaffected	generic	—
`[0,5.11.0)`	unaffected	semver	—
`[0,5.16.0)`	unaffected	semver	—
`[0,6.2.0)`	unaffected	semver	—
`[0,6.7.0)`	unaffected	semver	—
`[0,6.13.0)`	unaffected	semver	—
`[0,6.19.0)`	unaffected	semver	—
`[0,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the patch to bump the reference count of the nfs_server during FREE_STATEID
Restart the NFS service after updating the kernel to ensure the new reference counting is active
Until a patch is available, restrict or disable NFS services from untrusted clients to reduce exposure

Generated by OpenCVE AI on August 25, 2026 at 07:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0051.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd
https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e
https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd
https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c
https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2
https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890
https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894
https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8
https://lore.kernel.org/linux-cve-announce/2026082242-CVE-2026-74730-e35d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74730
https://www.cve.org/CVERecord?id=CVE-2026-74730

History

Tue, 25 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 24 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 24 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082242-CVE-2026-74730-e35d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74730 https://www.cve.org/CVERecord?id=CVE-2026-74730
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 22 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
Title		NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2 https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890 https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894 https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:33:19.659Z

Updated: 2026-08-25T05:42:09.527Z

Reserved: 2026-08-15T05:44:03.930Z

Link: CVE-2026-74730

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:48.137

Modified: 2026-08-25T06:18:59.463

Link: CVE-2026-74730

Redhat

Severity : Moderate

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74730 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-25T08:00:13Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object