Linux CVE-2026-31403

The Linux kernel NFSD (NFS Server Daemon) module maintains an /proc/fs/nfs/exports proc entry that persists for the module's lifetime. This entry uses a seq_file interface (exports_proc_open) to expose NFS export cache information to userspace. The vulnerability is rooted in improper lifetime management of network namespace (struct net) references within the cache_detail structure. When a process opens /proc/fs/nfs/exports after executing setns() to change its network namespace, the proc handler stores the namespace's svc_export_cache in the seq_file private data but does not increment the namespace's reference counter. Subsequently, if the namespace is destroyed (e.g., during container teardown), nfsd_net_exit() is invoked, which calls nfsd_export_shutdown() to free the cache_detail. Any subsequent read on the still-open file descriptor then dereferences this freed memory, accessing an invalid hash table. The root cause is a use-after-free (CWE-416 adjacent, though more specifically a reference counting issue) stemming from the mismatch between the proc entry's lifetime (module-wide) and the namespace's lifetime (application-specific). The fix leverages the fact that cache_detail already maintains a struct net pointer (cd->net, set during cache_create_net()), allowing exports_release() to acquire and hold a reference on that namespace without per-file storage overhead.