EUVD-2026-76570
GHSA-mr23-3fxm-cw86
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggering force_expire_client() needs privileged local write to the nfsd control file (PR:H, AV:L) and winning a kernel race (AC:H); impact is a use-after-free crash (A:H), with no confirmed C/I disclosure.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4_drop_revoked_stid() is still using it.
This cleanup runs from the laundromat, so a periodic sweep can race force_expire_client() driven by a write to the clients/<id>/ctl file.
Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().
AnalysisAI
Use-after-free in the Linux kernel's NFS server (NFSD) NFSv4.0 revoked-state cleanup path lets a race between the periodic laundromat sweep and administrative client expiry free an NFS client structure while it is still being dereferenced. In nfs40_clean_admin_revoked(), a stateid reference is held but does not pin the owning client, so nfsd4_drop_revoked_stid() can dereference s->sc_client after another thread frees the client. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a host running the in-kernel NFS server (NFSD) with active NFSv4.0 client state, and the ability to trigger force_expire_client() by writing to the nfsd control file clients/<id>/ctl in the mounted nfsd filesystem - an operation that needs privileged local access to that filesystem. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk and conflicts with the mechanics in the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or later) from your distribution once it ships the corresponding stable update, applying the fix commits published at git.kernel.org (e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux NFSD with NFSv4.0 enabled by checking kernel versions 6.9 and later. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today