Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-74730

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to < ed2f92ce2fc48463c41e0e540b9a3454889e8af8affected
  • 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to < d858ab09e787106432d4d9830bad9dfedf02f890affected
  • 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to < af62f1af182d33a0de38308c012841885d8ab92eaffected
  • 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to < caee6a68ffaa5016dfc01cd0b3dc1896a32e3abdaffected
  • 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to < ed1161ab6239761958b38d5667225634fc2be894affected
  • 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to < d71dfffa512e71b166a889484e4c3b148a9a3af2affected
  • 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to < 80ed3d762628b36c9e4b22fac7c65b72ef3b13ddaffected
  • 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to < cf616096a0f3a2b60f7d68b6b39674a6867ded9caffected

Linux Linux

Default version status: affected

  • 3.10affected
  • 0 to < 3.10unaffected
  • 5.10.265 to ≤ 5.10.*unaffected
  • 5.15.216 to ≤ 5.15.*unaffected
  • 6.1.183 to ≤ 6.1.*unaffected
  • 6.6.152 to ≤ 6.6.*unaffected
  • 6.12.104 to ≤ 6.12.*unaffected
  • 6.18.45 to ≤ 6.18.*unaffected
  • 7.1.9 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References