EUVD-2026-76581
GHSA-76rg-3h22-jw6r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable NFS but needs an authenticated client (PR:L) winning a tight race (AC:H); impact is chiefly a kernel crash (A:H) with limited C/I from the UAF.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: initialize copy-notify stateid before publishing it
nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state() and free the entry, turning the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window.
Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4_put_cpntf_state(); on a late error the laundromat reaps the entry.
AnalysisAI
Use-after-free in the Linux kernel NFSD server (nfsd4_copy_notify) lets a racing OFFLOAD_CANCEL operation free a copy-notify stateid before the COPY_NOTIFY caller finishes initializing and reading it, corrupting kernel memory on NFSv4.2 servers with inter-server copy offload. Affected are kernels from 5.6 up to the fixed 6.12.109/6.18.50/7.2.4/7.3-rc1 releases. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an NFSD server with NFSv4.2 inter-server copy offload in use (COPY_NOTIFY path reachable), and an authenticated NFS client able to issue both COPY_NOTIFY and a crafted OFFLOAD_CANCEL carrying the server-internal clientid (nn->s2s_cp_cl_id) plus a guessable so_id. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or a distribution kernel incorporating commits e08a3dcaca05 / a4d7fedcaaf3 / 4cdef96892f4 / 129643893b79 from git.kernel.org). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running NFSD with NFSv4.2 copy offload enabled using kernel versions 5.6 through 7.2.3. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today