EUVD-2026-76624
GHSA-cfxc-m2r2-5grw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote authenticated NFS client (AV:N/PR:L) winning a teardown race (AC:H) crashes the kernel (A:H); no data read or modification, so C:N/I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer.
The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item.
Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.
AnalysisAI
Use-after-free in the Linux kernel NFSD server's NFSv4.2 inter-server copy (SSC) teardown path allows a memory-corruption/crash condition when nfsd4_ssc_expire_umount() resumes its list walk after dropping nfsd_ssc_lock for an mntput(). The saved 'next' (tmp) entry is not pinned by the nsui_busy flag, so a concurrent nfsd RPC thread hitting nfsd4_ssc_cancel_dul() can list_del+kfree that entry in the lock-drop window, leaving the walk to dereference freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to be an NFS server with NFSv4.2 server-side / inter-server copy (SSC) actively in use - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or your distribution's backport referencing these commits) - the fix restarts the expire walk from the list head after the mntput() unlock window so no cached next pointer survives the lock drop, which the changelog notes is cheap since the mount list is small and expiry runs periodically. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Linux NFS servers to identify those with NFSv4.2 inter-server copy (SSC) functionality enabled and determine their kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today