EUVD-2026-76580
GHSA-9vcc-j8g4-f8ff
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because exploitation requires OOM-triggered init failure plus heap control; C/I:H preserved as kernel fops UAF theoretically enables ring-0 execution.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
nfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd(). If the slab allocation fails, the bare "return retval" bypasses nfsd_debugfs_exit(), leaving orphan debugfs files with stale fops pointers into the freed module text.
Move nfsd_debugfs_init() to after the slab init succeeds, so the early return has no debugfs state to clean up.
Since debugfs is now the more recently initialized of the two, also update the unwind paths to match reverse-initialization (LIFO) order: run nfsd_debugfs_exit() before nfsd4_free_slabs() in both the init_nfsd() error path and exit_nfsd(). The nfsd debugfs files only reference module-global state and have no dependency on the slab caches, so that reordering is a cleanup with no functional change.
AnalysisAI
Stale debugfs function pointers in Linux kernel NFSD create a use-after-free condition when module initialization fails partway through. Specifically, nfsd_debugfs_init() registers debugfs files containing fops pointers into module text before nfsd4_init_slabs() succeeds; if slab allocation then fails, the module's text is freed but the debugfs entries remain live with now-dangling pointers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the nfsd kernel module must be present on the system and an attempt to load it must have occurred; (2) nfsd4_init_slabs() must have returned an error during that load attempt, which in practice requires the system to be under significant memory pressure or slab exhaustion at that exact moment; (3) the debugfs filesystem must be mounted and accessible to the attacker (typically at /sys/kernel/debug), and the orphaned nfsd debugfs entries must still be present (i.e., no reboot has occurred); (4) for impact beyond a kernel panic, the attacker must additionally perform heap manipulation to control the freed memory region holding former module text. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is materially lower than the input CVSS of 7.8 suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux 6.18.50, 7.2.4, or any 7.3-rc1 or later kernel build that incorporates the three fix commits (4ae5d7490ae6, ab43ff94f5ddc, 2c390c8a1764d). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running affected NFSD kernel versions through patch management and vulnerability assessment tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today