EUVD-2026-80646
GHSA-j297-c8rv-68vc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggered by local privileged 'exportfs -u' (AV:L, PR:H) racing client teardown (AC:H); a UAF crash yields A:H with only incidental memory-corruption integrity (I:L) and no disclosure (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during export state revocation
nfsd4_revoke_export_states() has the same use-after-free as nfsd4_revoke_states(): it drops nn->client_lock across revoke_one_stid() and the following read of clp->cl_minorversion, but the stateid reference it holds does not pin the client. A teardown racing the dropped lock can free the client while revoke_one_stid() still dereferences it.
exportfs -u drives this path through NFSD_CMD_UNLOCK_EXPORT, so an administrator removing an export can race a client expiry.
Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().
AnalysisAI
A use-after-free in the Linux kernel NFSD (kernel NFS server) export-state revocation path can crash the server when a privileged administrator runs 'exportfs -u' to revoke an export while an NFSv4 client is concurrently expiring. Only recent 7.2.x kernels before 7.2.5 (and mainline before 7.3-rc1) are affected, and the trigger requires root/CAP_SYS_ADMIN on the NFS server plus a narrow race in which nn->client_lock is dropped across revoke_one_stid() and a subsequent read of clp->cl_minorversion, allowing a teardown to free the nfs4_client still being dereferenced. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the NFSD (kernel NFS server) subsystem to be active and serving at least one NFSv4 client with outstanding stateids. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) drastically overstates real-world risk and conflicts with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 7.2.5 or 7.3-rc1 (or later), which contain the fix commits 2108de53568a64936a0da3e04d85c35df98d3fb6 and c05ae58fe06ce2ac34312f649e71c3596bdde358 respectively; the patch is also carried in the stable tree at https://git.kernel.org/stable/c/2108de53568a64936a0da3e04d85c35df98d3fb6 and https://git.kernel.org/stable/c/c05ae58fe06ce2ac34312f649e71c3596bdde358, and details are recorded at https://nvd.nist.gov/vuln/detail/CVE-2026-90038. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux NFS servers and confirm whether they run 7.2.x kernels before 7.2.5 or mainline before 7.3-rc1; apply the vendor-released patch (7.2.5 stable or 7.3-rc1) to the highest-exposure systems first, and if immediate patching is not possible, restrict root/CAP_SYS_ADMIN access and avoid running 'exportfs -u' while NFSv4 clients are concurrently expiring. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today