EUVD-2026-76588
GHSA-gwc7-hc26-hx5g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authenticated NFS client (PR:L) over the network (AV:N) must win a timing race with kernel IDR walkers (AC:H); realistic impact is kernel crash/memory corruption (A:H), not data theft.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dup_copy_fields() copies only the value into async_copy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cs_type from it and, if the bytes look like an expired NFS4_COPYNOTIFY_STID, follows into refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has the same exposure via idr_find().
Duplicate the fields first, then register the stateid on the stable async_copy. result->cb_stateid is unchanged.
AnalysisAI
Use-after-free / dangling-pointer corruption in the Linux kernel NFSD server allows an NFSv4.2 client performing an asynchronous server-side COPY to leave a stale IDR entry in the s2s_cp_stateids table, pointing at per-request COMPOUND buffer memory that is immediately recycled. When the NFSD laundromat or manage_cpntf_state() later walks that IDR, it dereferences reused request memory and can be steered into refcount_dec()/idr_remove()/kfree() on attacker-influenced garbage, corrupting kernel memory or crashing the server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a Linux host acting as an NFS server with the nfsd module serving NFSv4.2 including server-side (inter-server) COPY support, and an attacker with an authenticated/mounted NFS client capable of issuing an asynchronous COPY (async COPY) request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) is inconsistent with the mechanism: exploitation requires an authenticated NFS client (PR:L, not PR:N) able to issue an asynchronous server-side COPY, and it hinges on a timing race between the background copy and the laundromat/manage_cpntf_state() walkers, which is closer to AC:H than AC:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.50, 7.2.4, or 7.3-rc1 (or a distribution kernel that backports fix commits 9b4e5e9ba5ae1..., 14b978e8d05ce..., d0beaee498e11...) available via git.kernel.org/stable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running NFSD with NFSv4.2 enabled, typically in enterprise storage, shared file systems, and high-performance computing clusters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today