EUVD-2026-64417
GHSA-rmc7-77jw-fvm4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Client-side UAF needing an NFSv4 mount and a race between delayed FREE_STATEID and teardown gives AC:H and adjacent/server-influenced vector (AV:A); realistic impact is DoS (A:H) with limited corruption (I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
AnalysisAI
A use-after-free in the Linux kernel's NFSv4 client can occur when a FREE_STATEID operation is delayed and the associated 'struct nfs_server' is torn down (for example on unmount) while the operation is still in flight, leaving the RPC referencing freed memory. The fix pins the nfs_server by bumping its refcount for the duration of the FREE_STATEID call. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active NFSv4 client mount ('struct nfs_server' in use) and a FREE_STATEID operation that is delayed long enough to overlap with cleanup/teardown of that nfs_server object - i.e., a race window between an in-flight FREE_STATEID RPC and the freeing of the mount context. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and should be reconciled before treating the headline score as authoritative. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A host has an NFSv4 filesystem mounted from a server the attacker can influence (or that is simply slow/unreliable); the attacker or conditions cause a FREE_STATEID RPC to be delayed while the mount is being torn down, so the kernel dereferences the freed 'struct nfs_server'. The most reliable outcome is a kernel crash (denial of service), with a theoretical but much harder path to memory corruption. … |
| Remediation | Vendor-released patch: update to a fixed stable kernel - the relevant patched versions include 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2, so upgrade to the fixed release for your series and reboot. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems using NFSv4 mounts and prioritize kernel patch deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today