EUVD-2026-76594
GHSA-hvfh-9745-ghhq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggering the teardown race requires administrative control over nfsd namespace lifecycle, warranting AV:L/PR:H; AC:H reflects the inherent timing window of a race condition.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing files (see ffb402596147). However, the queue lives in a separately-allocated struct nfsd_fcache_disposal that is freed by nfsd_free_fcache_disposal_net() during per-net teardown. The global shrinker, laundrette, and fsnotify callbacks can still be inside nfsd_file_dispose_list_delayed() dereferencing that pointer, causing a use-after-free.
Inline the spinlock and freeme list directly into struct nfsd_net (as fcache_dispose_lock and fcache_dispose_list), eliminating the separately allocated struct nfsd_fcache_disposal entirely. These fields now have the same lifetime as the net namespace itself, so there is no dangling pointer to chase.
nfsd_file_cache_start_net() now just initializes the inline fields and cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains the inline list directly instead of freeing a separate struct. The alloc/free helpers are removed.
AnalysisAI
Use-after-free in the Linux kernel NFS server (nfsd) file-cache disposal path allows concurrent kernel subsystem callbacks - the global memory shrinker, nfsd laundromat garbage collector, and fsnotify - to dereference a freed nfsd_fcache_disposal struct during per-network-namespace teardown, producing kernel heap corruption or a system panic. The vulnerable window opens when a network namespace hosting nfsd is destroyed while disposal callbacks remain in-flight; containerized NFS server deployments (Docker, Kubernetes) are the most realistic trigger scenario. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) nfsd actively serving NFS in a Linux network namespace that is undergoing teardown - most commonly a Docker or Kubernetes container, or an explicit ip-netns namespace, running an NFS server that is stopped or deleted; (2) concurrent execution of the kernel memory shrinker callback, the nfsd laundromat garbage-collector timer, or a fsnotify callback that calls nfsd_file_dispose_list_delayed() at the precise moment nfsd_free_fcache_disposal_net() has freed the disposal struct. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The assigned CVSS vector (AV:N/AC:H/PR:N) substantially overstates exploitability: no crafted NFS network packet alone can trigger this race - the vulnerable window requires a privileged administrative actor to tear down the network namespace or stop nfsd while the kernel shrinker or laundromat is concurrently dereferencing the disposal struct. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4, 6.18.51, or 7.3-rc1 (or any later release), which inline the fcache disposal fields directly into struct nfsd_net and eliminate the race entirely. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running containerized NFS servers, particularly Kubernetes clusters and Docker hosts using network-namespace-isolated storage. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today