Vulnerability-Lookup

CVE-2026-74730 (GCVE-0-2026-74730)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42

Title

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Summary

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ed2f92ce2fc48463c…
https://git.kernel.org/stable/c/d858ab09e78710643…
https://git.kernel.org/stable/c/af62f1af182d33a0d…
https://git.kernel.org/stable/c/caee6a68ffaa5016d…
https://git.kernel.org/stable/c/ed1161ab623976195…
https://git.kernel.org/stable/c/d71dfffa512e71b16…
https://git.kernel.org/stable/c/80ed3d762628b36c9…
https://git.kernel.org/stable/c/cf616096a0f3a2b60…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < ed2f92ce2fc48463c41e0e540b9a3454889e8af8 (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < d858ab09e787106432d4d9830bad9dfedf02f890 (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < af62f1af182d33a0de38308c012841885d8ab92e (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < ed1161ab6239761958b38d5667225634fc2be894 (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < d71dfffa512e71b166a889484e4c3b148a9a3af2 (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < cf616096a0f3a2b60f7d68b6b39674a6867ded9c (git)	guessed
Linux	Linux	Affected: 3.10 Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed2f92ce2fc48463c41e0e540b9a3454889e8af8",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "d858ab09e787106432d4d9830bad9dfedf02f890",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "af62f1af182d33a0de38308c012841885d8ab92e",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "ed1161ab6239761958b38d5667225634fc2be894",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "d71dfffa512e71b166a889484e4c3b148a9a3af2",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "80ed3d762628b36c9e4b22fac7c65b72ef3b13dd",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "cf616096a0f3a2b60f7d68b6b39674a6867ded9c",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call\n\nDan Aloni reports that he was able to hit a use-after-free bug if a\nFREE_STATEID operation gets delayed for whatever reason. Fix this by\nbumping the refcount of the \u0027struct nfs_server\u0027 object for the duration\nof the FREE_STATEID so it doesn\u0027t get cleaned up from underneath us\nwhile operations are still in flight."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the NFSv4 client FREE_STATEID path: nfs41_free_stateid_prepare/done/release use a freed struct nfs_server while handling async RPC completions driven by NFSv4 replies from the mounted server and by server-initiated CB_RECALL/CB_RECALLANY callbacks on the NFS backchannel.\nAC:L - The attacker controls both sides of the race: they provoke FREE_STATEID via revocation responses or callbacks, keep it in flight with NFS4ERR_DELAY, and time nfs_server teardown via user-mount umount, automount idle expiry, or the concurrent stateid cleanup that runs during umount itself.\nPR:N - A malicious or compromised NFSv4 server needs no account or elevated capability on the victim client once an NFSv4.1+ mount exists; FREE_STATEID is issued automatically during server-driven stateid revocation handling without any client-side privileges at exploit time.\nUI:N - After an NFS mount exists (boot-time, autofs, or Kubernetes volumes are common), no further victim action is needed: the attacker drives recall/revocation on the wire and mount teardown follows from automated autofs expiry or attacker-controlled umount on a user-mounted export.\nS:U - The use-after-free corrupts kernel heap within the NFS client on the same host; it is a standard kernel memory-safety bug, not a VM escape, container breakout, or IOMMU/DMA boundary crossing.\nC:H - Freed struct nfs_server objects are kmalloc\u0027d and callbacks dereference nfs_client, rpc_clnt, and super_block fields after nfs_free_server/call_rcu, giving a classic UAF read primitive over attacker-influenced heap contents including function pointers.\nI:H - UAF on struct nfs_server exposes destroy hooks, RPC client handles, and client/session state pointers that an attacker can reschedule via heap grooming, yielding write and control-flow primitives typical of NFS client heap corruption bugs.\nA:H - Use of a freed nfs_server in RPC prepare/done/release paths causes kernel oops or panic; Dan Aloni demonstrated reliable reproduction, and UAFs in this path crash hosts even when not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:42:09.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890"
        },
        {
          "url": "https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e"
        },
        {
          "url": "https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894"
        },
        {
          "url": "https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2"
        },
        {
          "url": "https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c"
        }
      ],
      "title": "NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74730",
    "datePublished": "2026-08-22T15:33:19.659Z",
    "dateReserved": "2026-08-15T05:44:03.930Z",
    "dateUpdated": "2026-08-25T05:42:09.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74730",
      "date": "2026-08-25",
      "epss": "0.0051",
      "percentile": "0.41218"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:43:25.000Z",
      "cve": "CVE-2026-74730",
      "id": "msrc_CVE-2026-74730",
      "initial_release_date": "2026-08-24T01:09:56.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74730.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74730\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:48.137\",\"lastModified\":\"2026-08-25T06:18:59.463\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call\\n\\nDan Aloni reports that he was able to hit a use-after-free bug if a\\nFREE_STATEID operation gets delayed for whatever reason. Fix this by\\nbumping the refcount of the \u0027struct nfs_server\u0027 object for the duration\\nof the FREE_STATEID so it doesn\u0027t get cleaned up from underneath us\\nwhile operations are still in flight.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfs/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"ed2f92ce2fc48463c41e0e540b9a3454889e8af8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"d858ab09e787106432d4d9830bad9dfedf02f890\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"af62f1af182d33a0de38308c012841885d8ab92e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"ed1161ab6239761958b38d5667225634fc2be894\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"d71dfffa512e71b166a889484e4c3b148a9a3af2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"80ed3d762628b36c9e4b22fac7c65b72ef3b13dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"cf616096a0f3a2b60f7d68b6b39674a6867ded9c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfs/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:56:34+00:00",
      "cve": "CVE-2026-74730",
      "id": "CVE-2026-74730",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74730.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-74730

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-08-25 06:18

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed2f92ce2fc48463c41e0e540b9a3454889e8af8",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "d858ab09e787106432d4d9830bad9dfedf02f890",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "af62f1af182d33a0de38308c012841885d8ab92e",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "ed1161ab6239761958b38d5667225634fc2be894",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "d71dfffa512e71b166a889484e4c3b148a9a3af2",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "80ed3d762628b36c9e4b22fac7c65b72ef3b13dd",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "cf616096a0f3a2b60f7d68b6b39674a6867ded9c",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call\n\nDan Aloni reports that he was able to hit a use-after-free bug if a\nFREE_STATEID operation gets delayed for whatever reason. Fix this by\nbumping the refcount of the \u0027struct nfs_server\u0027 object for the duration\nof the FREE_STATEID so it doesn\u0027t get cleaned up from underneath us\nwhile operations are still in flight."
    }
  ],
  "id": "CVE-2026-74730",
  "lastModified": "2026-08-25T06:18:59.463",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-22T16:16:48.137",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-RMC7-77JW-FVM4

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74730"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call\n\nDan Aloni reports that he was able to hit a use-after-free bug if a\nFREE_STATEID operation gets delayed for whatever reason. Fix this by\nbumping the refcount of the \u0027struct nfs_server\u0027 object for the duration\nof the FREE_STATEID so it doesn\u0027t get cleaned up from underneath us\nwhile operations are still in flight.",
  "id": "GHSA-rmc7-77jw-fvm4",
  "modified": "2026-08-25T06:31:31Z",
  "published": "2026-08-22T18:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74730"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-74730

Vulnerability from csaf_microsoft - Published: 2026-08-24 01:09 - Updated: 2026-08-24 14:43

Summary

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-74730

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-74730 NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74730.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call",
    "tracking": {
      "current_release_date": "2026-08-24T14:43:25.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.282Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-74730",
      "initial_release_date": "2026-08-24T01:09:56.000Z",
      "revision_history": [
        {
          "date": "2026-08-24T01:09:56.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-24T14:43:25.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74730",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-74730 NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74730.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-24T01:09:56.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74730 (GCVE-0-2026-74730)

FKIE_CVE-2026-74730

GHSA-RMC7-77JW-FVM4

MSRC_CVE-2026-74730

Tags

Sightings

Nomenclature