EUVD-2026-76589
GHSA-rgqw-p3pf-j5p9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authenticated NFS client (PR:L) over the network (AV:N) hitting a race in a non-default re-export config (AC:H); UAF crashes the server (A:H) with no confirmed C/I impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
dentry_create() can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server returned to OPEN a filehandle which matched a directory that was already in the dcache. Clearly this would not be expected!
If this were to happen the dentry (child) that was already stored in resfhp could be freed and later dereferenced.
We shouldn't call fh_compose() until we are certain that we have the final dentry, so this patch moved the fh_compose() call to two places: one for the case where the target already exists, and one after dentry_create() where it was created.
AnalysisAI
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the NFS server to be re-exporting an NFS mount (exporting a filesystem that is itself NFS) - this is what makes dentry_create() able to return a different dentry than the one passed in. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 7.2.4 or 7.3-rc1 (or a distribution kernel that backports the upstream fix commits 033e783709ce and 3e2c79360c6a), which relocate the fh_compose() call so it runs only after the final dentry is known - both for the already-exists case and after dentry_create() succeeds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine whether your infrastructure includes NFS re-export server configurations (Linux systems exporting mounted NFS filesystems). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today