EUVD-2026-76592
GHSA-x88v-7xqf-ff34
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Requires authenticated NFS client (PR:L) and non-default inter-server SSC configuration (AC:H); availability-only impact from resource exhaustion.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix nfsd_file leak on inter-server COPY setup failure
When nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns nfserr_offload_denied directly, bypassing the out: label where release_copy_files() would drop the nf_dst reference taken by nfs4_preprocess_stateid_op(). Each failed inter-server COPY leaks one nfsd_file, pinning file/inode/dentry/vfsmount.
Fix by setting status and jumping to out: instead of returning directly.
AnalysisAI
Resource exhaustion in the Linux kernel NFSv4.2 inter-server copy (COPY offload) path allows an authenticated NFS client to leak nfsd_file objects on the server. Each inter-server COPY request that triggers a failed nfsd4_setup_inter_ssc() call bypasses the cleanup path where release_copy_files() drops the nf_dst reference, permanently pinning a file, inode, dentry, and vfsmount. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target Linux system must be running as an NFSv4.2 NFS server (nfsd) with inter-server server-side copy (SSC) support enabled - a non-default, operationally niche configuration; (2) the attacker must be an authenticated NFS client holding a valid stateid for the destination file, as nfs4_preprocess_stateid_op() must succeed before the vulnerable path is reached (PR:L minimum); (3) the inter-server copy setup (nfsd4_setup_inter_ssc) must fail, which occurs when the designated source NFS server is unreachable or misconfigured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) is materially overstated for this vulnerability: inter-server copy requires an NFS client holding a valid stateid processed by nfs4_preprocess_stateid_op(), meaning PR:N is incorrect - at minimum PR:L (authenticated NFS client) applies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, which correct the control flow in nfsd4_copy() to jump to the out: label on nfsd4_setup_inter_ssc() failure, ensuring release_copy_files() always executes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify whether NFSv4.2 inter-server copy offload is enabled on any Linux NFS servers and document which systems are affected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today