CVE-2026-74730

9.8Critical

Published 22 Aug 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: —

Impact

A remote network peer or malicious NFS server can trigger a kernel panic or potential code execution via a use-after-free condition. It requires the target system to have an active NFS mount handling delayed state operations.

Root cause

The Linux NFS client fails to increment the reference count on the 'nfs_server' structure during a FREE_STATEID call, allowing the structure to be freed while operations are still pending.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the Linux kernel to an updated release containing the backported git patches. If patching must wait, unmount NFS shares or restrict NFS client network traffic.

shell

$ uname -r

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-74730