EUVD-2026-76596
GHSA-83g2-j7m2-94hx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NFSv4.2 requires authenticated client session (PR:L) and exploitation depends on a precise race window (AC:H); impact is crash-only with no C/I consequence.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix cpntf publish race in nfs4_init_cp_state
nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server.
Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.
AnalysisAI
Race condition in the Linux kernel NFSD NFSv4.2 server-side copy state management allows any authenticated NFSv4.2 client to crash the NFS server kernel. The cpntf entry is inserted into the IDR (making it immediately addressable by stateid) before its cp_list is initialized in a separate lock section; a concurrent OFFLOAD_CANCEL - using the cnr_stateid echoed to the client - reaches _free_cpntf_state_locked() and calls list_del() on a zeroed list_head, triggering a kernel oops. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a Linux NFS server running kernel 5.6 through the unpatched stable versions with NFSv4.2 support compiled in (CONFIG_NFSD enabled, NFSv4.2 COPY offload support present) and the server actively accepting NFSv4.2 client connections. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N) overstates exploitability in two dimensions: the race condition demands precise timing (AC:H is more accurate), and NFSv4.2 inherently requires an authenticated client session (PR:L is more realistic). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 using distribution-provided packages or by applying the four upstream fix commits (21d6c5957f5c, a631a26a8777, c7270f62e7a0, be3a5c1d857b) from git.kernel.org/stable/c/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production Linux systems running NFS servers and document their kernel versions and NFSv4.2 configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today