EUVD-2026-76621
GHSA-g58f-8h46-hjgv
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires CAP_SYS_MODULE (PR:H) to rmmod nfsd and precise race timing (AC:H); UAF in kernel context yields full C/I/A impact but local-only trigger.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free.
Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.
AnalysisAI
Use-after-free and NULL pointer dereference in the Linux kernel's lockd/nfsd subsystem allow a race between nfsd module teardown and in-flight lockd dispatch to dereference freed module memory, causing kernel panic or potential slab corruption. Any Linux NFS server running both nfsd and lockd (NFSv2/NFSv3 file locking) from kernel 2.6.12 through pre-7.2.4 is affected when nfsd is dynamically unloaded during active NFS lock operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions are required: (1) the target Linux system is operating as an NFS server with both the nfsd and lockd kernel modules loaded and actively serving NFSv2 or NFSv3 clients that use file locking (LOCK/UNLOCK operations); (2) a user with CAP_SYS_MODULE privilege (effectively root) executes rmmod nfsd, unloads the nfsd module via modprobe -r, or triggers an unclean nfsd service stop that races module teardown; and (3) a lockd dispatch call referencing nlmsvc_ops is in-flight at the precise moment nfsd_lockd_shutdown() clears the pointer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N) materially overstates the attack vector and privilege requirements. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4 or 7.3-rc1 or later, or apply the upstream stable patches directly from https://git.kernel.org/stable/c/3c461a1820088fb5889d73a6522369bde45527a9 and https://git.kernel.org/stable/c/641e5e20852359b8c31149be4598884e30652f60. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux NFS servers running kernel versions 2.6.12 through 7.2.3 with nfsd and lockd enabled; establish an immediate operational ban on dynamic nfsd module unloading during normal business hours. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today