EUVD-2026-76615
GHSA-4288-gh8m-45g7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Needs an authenticated NFSv4 client (PR:L) and a delegation-revoke/teardown race (AC:H); realistic impact is kernel crash (A:H) with no confidentiality/integrity effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before releasing cl_lock. revoke_delegation() uses this flag to detect whether FREE_STATEID has already processed the delegation -- without it, the freed delegation is added to cl_revoked via list_add(), producing a use-after-free when cl_revoked is later traversed in __destroy_client().
The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already sets SC_STATUS_FREED correctly. Apply the same pattern to the SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().
AnalysisAI
Use-after-free in the Linux kernel NFSD server (nfsv4 state machine) arises because nfsd4_drop_revoked_stid() processes FREE_STATEID for admin-revoked delegations without setting the SC_STATUS_FREED flag before dropping cl_lock. Because revoke_delegation() relies on that flag to tell whether FREE_STATEID has already handled the delegation, the freed delegation is re-added to the client's cl_revoked list via list_add(), and the dangling entry is later dereferenced when cl_revoked is walked during __destroy_client(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated NFSv4 client session against a Linux NFS server with delegations in use, and specifically the admin-revoked-delegation flow where the client issues FREE_STATEID for a delegation that is then revoked. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or your distribution's kernel that backports the corresponding stable commits d832a0587528 / 1e4795766719 / a6d89032e5c6 / 650d370cfbc6), which set SC_STATUS_FREED in nfsd4_drop_revoked_stid() for the admin-revoked delegation path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production systems running Linux kernel versions 6.11.6 through 7.3-rc1 with NFSv4 support enabled using 'uname -r' and kernel configuration audit. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today