EUVD-2026-76600
GHSA-mq7m-fxw5-rr6m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authenticated NFSv4 client required (PR:L) winning a narrow teardown race (AC:H) over the network; impact is a UAF/refcount crash so A:H with no substantiated C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
In nfs4_preprocess_seqid_op() the stateid is obtained from nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid (sc_count) but takes no reference on the stateowner. openlockstateid() merely casts that stid and likewise takes no reference.
When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is being torn down, RP_UNHASHED) it has not taken a stateowner reference on that path. The error handling nevertheless called nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference the function never acquired -- risking a stateowner refcount underflow and use-after-free -- while leaking the sc_count reference held on the stid. The leaked stid reference can also stall a concurrent nfsd4_close_open_stateid() waiting for sc_count to drop.
Drop the reference actually held -- the stid -- before retrying. The stateowner stays alive through the reference held by the stid. This mirrors the open path in nfsd4_process_open1(), where the put balances a reference that path explicitly holds on the stateowner.
AnalysisAI
Denial of service (and potential local privilege escalation) in the Linux kernel's NFS server (nfsd) arises from a stateowner reference-count underflow on the NFSv4 seqid-operation replay retry path. When nfsd4_cstate_assign_replay() returns -EAGAIN because the replay owner is being torn down (RP_UNHASHED), nfs4_preprocess_seqid_op() erroneously called nfs4_put_stateowner() on a reference it never acquired, corrupting so_count and risking a use-after-free, while simultaneously leaking the sc_count reference held on the stid. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a host running the in-kernel NFSv4 server (nfsd) with an active export, and an attacker holding an authenticated NFSv4 session (a valid mount/state) able to issue seqid operations (OPEN/LOCK/CLOSE/OPEN_DOWNGRADE). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) substantially overstates real-world risk for this bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or later) as appropriate to your stable branch, or apply the stable backport commits (00843074d9b8, 69ed78b6b947, f7cb90ddc021, 5e4627d3513e) referenced at https://git.kernel.org/stable/c/00843074d9b84824552c9679d423d29500ca5de0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running Linux NFS servers with NFSv4 support and document their kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today