Skip to main content

Linux Kernel EUVDEUVD-2026-59371

| CVE-2026-72472 CRITICAL
2026-08-15 Linux GHSA-r6m9-5pwq-jfm2
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local execution on NFSv4 client
  2. Delivery
    Acquire byte-range file locks on NFS inode
  3. Exploit
    Induce delegation recall or state recovery
  4. Execution
    Race lock/unlock against unprotected list traversal
  5. Persist
    Trigger use-after-free on file-lock objects
  6. Impact
    Kernel memory corruption / client crash

Vulnerability Assessment

Exploitation Conditions

Requires an NFSv4 (v4.x) client mount with delegations in use: the vulnerable window opens during delegation recall (nfs_delegation_claim_locks / nfs4_lock_delegation_recall) and during lock reclaim/state recovery (nfs4_reclaim_locks, nfs4_locku_done, nfs4_lock_done), and the inode must have active byte-range file locks - often with multiple nfs4_state instances on a single inode. Exploitation is limited by being a timing-dependent race (must be won during recovery/recall, not on demand), by requiring local activity on the NFS client to drive locking operations, and by requiring NFSv4 with delegations rather than a default idle mount; systems using NFSv3 or without delegations do not reach the affected code. Authentication requirements are not confirmed from available data - the provided CVSS PR:N is inconsistent with the local, client-side code path described.
Impact

The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is almost certainly an automated over-rating typical of bulk Linux-kernel CVE assignments and conflicts with the technical facts: the flaw is a locking race in NFS client state recovery, reachable through local NFS client activity and delegation/reclaim events rather than an unauthenticated network packet, so AV:N and PR:N are not supported by the description. Corroborating lower-risk signals: EPSS is 0.21% (11th percentile), there is no KEV listing and no known POC, and successful exploitation depends on winning a narrow timing window during delegation recall or lock reclaim, which is hard to drive deterministically. The realistic worst case is a kernel crash/DoS on the NFS client, with local privilege escalation being theoretically possible for UAF but unproven here. Net: treat this as a routine but real kernel-hardening fix - schedule it in normal stable-kernel patch cycles rather than as an emergency, while noting the CVSS-vs-description mismatch (network/no-priv vector claimed, but the code path implies local NFS-client access) should be verified against the vendor commit before relying on the score.
Exploit ScenarioDerived

A local user or workload on an NFSv4-mounted host holds byte-range locks while the server issues a delegation recall or the client enters state recovery, and an attacker repeatedly races lock/unlock operations against the recovery path to trigger the use-after-free on the file-lock list. The most reliable observable outcome is a kernel crash (denial of service) on the client; memory-corruption-based escalation would require additional, non-trivial heap grooming. No public exploit code has been identified at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Use-after-free memory corruption in the Linux kernel's NFSv4 client fixes a race in file-lock list traversal, where nfs_delegation_claim_locks, nfs4_locku_done, and nfs4_lock_done manipulated the inode file-lock list without holding nfsi->rwsem, allowing the list to change under iteration during delegation recall and lock reclaim. The fix serializes traversal under nfsi->rwsem and relocates locks_lock_inode_wait into _nfs4_proc_setlk. This is a locally-triggered kernel race affecting NFSv4 client mounts; no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.

RemediationAI

Upstream fix available (stable-tree commits); apply the vendor-released patched kernels 6.12.97, 6.18.40, or 7.1.5 (or 7.2-rc1) matching your branch, obtained via your distribution's kernel updates rather than manual patching where possible. The specific fixes are kernel.org stable commits 1cda95bf2e9c, f161ef7b0dd2, e68035178e65, and 4837fb36219e; verify your running branch maps to one of these. If immediate patching is not possible, the practical compensating control is to reduce reliance on the vulnerable NFSv4 client path - avoid NFSv4 delegations (mount with options that disable delegation where supported, or fall back to NFSv3 which does not exercise this delegation-recall/state-recovery code) on affected hosts, accepting the performance and caching trade-offs of losing delegations; restricting which hosts act as NFSv4 clients also shrinks exposure. There is no remote-facing feature to disable, so network-level controls are of limited value here.

Affected VersionsENISA

Linux patch: 7.2-rc1
Linux c69899a17ca4836230720e65493942d9582a0424 <f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218
Linux 4.0
Linux patch: 7.1.5
Linux c69899a17ca4836230720e65493942d9582a0424 <e68035178e65e2b3aa386ce61202ff33724ae418
Linux c69899a17ca4836230720e65493942d9582a0424 <4837fb36219e6c08b666bc31a86841bad8526358
Linux patch: 6.12.97
Linux patch: 0
Linux patch: 6.18.40
Linux c69899a17ca4836230720e65493942d9582a0424 <1cda95bf2e9c0e6b63545b7565fe4a1e474322f4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the Linux kernel NFSv4 client's byte-range file locking and state/delegation recovery machinery (fs/nfs). File locks are tracked on a per-inode list normally protected by flc_lock, but recovery paths such as nfs_delegation_claim_locks and nfs4_reclaim_locks cannot hold flc_lock across recover_lock / nfs4_lock_delegation_recall because those calls may block for a long time (RPC round-trips). The kernel therefore uses the inode's nfsi->rwsem to protect list traversal instead; the bug is that several paths dropped or never took that protection, so the lock list could be mutated concurrently, yielding a use-after-free on nfs4_state / file-lock objects. The root cause is a classic race-condition / concurrent-list-mutation UAF (CWE-416-class, though CWE is listed N/A here); the regression window traces to commit c69899a17ca4 which made VFS byte-range lock updates atomic with the stateid update.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.8 MEDIUM

Locally-triggered NFSv4 client race (AV:L, AC:H), needs local access to drive lock ops (PR:L); realistic impact is client crash (A:H) with only potential, unproven memory disclosure/corruption (C:L/I:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfs: use nfsi->rwsem to protect traversal of the file lock list

Lingfeng identified a bug and suggested two solutions, but both appear to have issues.

Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case.

Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set.

Executive ViewAI

Why It Matters

A critical use-after-free vulnerability in the Linux kernel's NFSv4 client could allow local attackers to cause kernel crashes or potentially execute code with elevated privileges on systems using NFSv4 mounts. While assigned CRITICAL severity with a 9.8 CVSS score, real-world exploitation risk remains minimal-no public exploit identified at time of analysis, with only 0.2% EPSS score. Linux environments dependent on NFSv4 file sharing should apply available patches during normal maintenance cycles, but this does not represent an emergency-level threat.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not possible, restrict local user access to systems with NFSv4 mounts and implement monitoring of kernel crash logs for exploitation signatures.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
Ubiquitous
Linux kernel with NFSv4 client is deployed across most enterprise environments
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-72472 ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/390711 REF https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4 REF https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358 REF https://git.kernel.org/stable/c/7813adb38c88573b730219c1dc1b630dfab7165e REF https://git.kernel.org/stable/c/e68035178e65e2b3aa386ce61202ff33724ae418 REF https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy