EUVD-2026-76599
GHSA-vpqx-gvmc-m7vf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AC:H because the triggering code path is explicitly described as extremely unlikely; PR:L because NFSv4 requires authenticated clients to issue OPEN(create) requests.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file
->atomic_open is permitted to return success without actually opening the file. It indicates this by calling finish_no_open(). This means dentry_create() can return a file which hasn't been opened. This is extremely unlikely as ->atomic_open handlers typically use finish_no_open() only for already existing files, and dentry_create() isn't called in that case, and the parent being locked should prevent races.
However out of an abundance of caution it seems wise to teach nfsd to only use the file returned by dentry_create() if FMODE_OPENED is set, indicating that it has in fact been opened.
AnalysisAI
Defensive hardening in the Linux kernel NFSD subsystem closes an edge case where nfsd_file_do_acquire() could use a file returned by dentry_create() that was never actually opened. The POSIX VFS interface permits ->atomic_open handlers to return success while delegating the open to a retry path via finish_no_open(); if that path is reached during an NFSv4 file creation, the resulting struct file lacks FMODE_OPENED and is in an invalid state for server I/O. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a running NFSD daemon with at least one active NFSv4 export. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H, 7.5) is materially overstated on two axes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to Linux kernel 7.2.4 (stable) or apply the mainline 7.3-rc1 patch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production systems running NFS servers and determine which Linux kernel versions are installed, checking against vendor advisories for affected versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today