EUVD-2026-76574
GHSA-h9v2-7c48-mpxj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable over the network but requires an authenticated NFS client (PR:L) and winning a non-deterministic laundromat race (AC:H); impact is a server crash (A:H), no confidentiality/integrity.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent lock owner use-after-free during client teardown
__destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present.
__destroy_client() then walks the table, calling remove_blocked_locks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flc_owner. The per-net laundromat reaps blocked locks from nn->blocked_locks_lru independently of client state. The two paths share blocked_locks_lock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as __destroy_client() dereferences it, a NULL dereference in remove_blocked_locks().
nfsd4_release_lockowner() holds a reference across the same call; __destroy_client() does not. Hold cl_lock across the walk, taking a reference and unhashing each owner, then drop it before remove_blocked_locks() and nfs4_put_stateowner(), which take blocked_locks_lock and cl_lock.
AnalysisAI
Denial of service (and potential privilege-context corruption) in the Linux kernel's NFSv4 server (NFSD) arises from a use-after-free/NULL-dereference when a client is torn down. A lock owner whose only reference is a blocked lock (nbl) is not counted by client_has_state(), so a DESTROY_CLIENTID operation can reach __destroy_client(), which walks the owner hash table calling remove_blocked_locks() on such owners without holding a reference; the per-net laundromat concurrently reaps the same blocked locks and frees the owner, causing a dereference of freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a running Linux NFSv4 server (NFSD) reachable by the attacker, an established client session able to create a lock owner that is held only by a blocked lock (nbl), and the ability to issue a DESTROY_CLIENTID operation for that client. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading to a fixed stable kernel: 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or your distribution's backport referencing these commits). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production systems running affected Linux kernel versions (prior to 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1) that operate NFSv4 servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today