EUVD-2026-38894
GHSA-5968-j93g-c79f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reachable over the network via NFS but requires winning a non-deterministic refcount race (AC:H); no auth needed for client traffic (PR:N); availability-only impact (A:H), no C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg
In nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already set by another thread, __nfs4_file_get_access should not be called to increment the nfs4_file access count since that was already done by the thread that added READ access to the file. The extra fi_access count in nfs4_file can prevent the corresponding nfsd_file from being freed.
When stopping nfs-server service, these extra access counts trigger a BUG in kmem_cache_destroy() that shows nfsd_file object remaining on __kmem_cache_shutdown.
This problem can be reproduced by running the Git project's test suite over NFS.
AnalysisAI
Denial of service in the Linux kernel's NFSD (in-kernel NFSv4 server) arises from an nfs4_file reference-count leak in nfsd4_add_rdaccess_to_wrdeleg, where __nfs4_file_get_access is wrongly called even when another thread has already taken READ access on the file. The leaked fi_access count keeps the backing nfsd_file pinned, so stopping the nfs-server service triggers a kernel BUG in kmem_cache_destroy() because nfsd_file objects remain on cache shutdown. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a target running the Linux in-kernel NFSv4 server (nfsd) with write delegations enabled (the default for NFSv4), since the bug is in the write-delegation read-access path nfsd4_add_rdaccess_to_wrdeleg. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and the headline CVSS likely overstates remote risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An NFS client (or many clients) generates concurrent read and write activity against files served by a vulnerable kernel's NFSv4 server with write delegations - for example running a metadata-heavy workload like the Git test suite over the mount - repeatedly hitting the racey READ-access-add path. Leaked nfs4_file/nfsd_file references accumulate over time, and when an administrator later stops or restarts the nfs-server service the kernel hits a BUG in kmem_cache_destroy(), degrading or crashing the server. … |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.33, 7.0.10, or 7.1 (or your distribution's backported equivalent) - apply the stable fix corresponding to your kernel series; the upstream commits are at https://git.kernel.org/stable/c/4584229395d0d65bd517780afe97ffea07cb2c3d, https://git.kernel.org/stable/c/b81572b073441dfd32213e41857676d0dbff4665, and https://git.kernel.org/stable/c/b48f44f36e6607b2f818560f19deb86b4a9c717b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running in-kernel NFSD with kernel versions before 6.18.33, 7.0.10, or 7.1; prioritize production NFS servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today