CRITICAL Introduced in 3.10
nfs FreeStateid UAF
CVE-2026-74730
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
02KernelScan AI Analysis
Risk summary
A use-after-free in the NFSv4 client can be triggered when an asynchronous FREE_STATEID operation is delayed and the underlying nfs_server is torn down before the RPC completes. Any local user with access to an NFS-mounted filesystem can trigger the vulnerable code path through normal file operations. Successful exploitation could lead to kernel memory corruption, privilege escalation, or a system crash.
Vulnerability analysis
The NFSv4 client can free a server object while an asynchronous cleanup operation is still in flight. If that operation is delayed by network conditions or server issues, the completion handling may run after the object has already been destroyed, leading to use-after-free. The fix ensures the client keeps the server object alive for the entire duration of the asynchronous operation, dropping the reference only after the reply is handled. If the object is already being torn down, the cleanup is skipped instead of using stale memory. Any local user with access to files on an NFS mount can trigger this through normal file operations; mounting the filesystem requires administrator privileges, but the operations that trigger the vulnerable state management do not.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.10 | 5.10.265 | ed2f92ce2fc4 |
| 5.15 | 3.10 | 5.15.216 | d858ab09e787 |
| 6.1 | 3.10 | 6.1.183 | af62f1af182d |
| 6.12 | 3.10 | 6.12.104 | ed1161ab6239 |
| 6.18 | 3.10 | 6.18.45 | d71dfffa512e |
| 6.6 | 3.10 | 6.6.152 | caee6a68ffaa |
| 7.1 | 3.10 | 7.1.9 | 80ed3d762628 |
| mainline | 3.10 | 7.2 | cf616096a0f3 |
| cip/4.19 | 3.10 | 4.19.325-cip136 | 9ff43b4c7c04 |
| cip/4.19-rt | 3.10 | 4.19.325-cip136-rt50 | 9ff43b4c7c04 |
| cip/4.4 | 3.10 | 4.4.302-cip115 | 412fc563a723 |
| cip/4.4-rt | 3.10 | 4.4.302-cip115-rt63 | 412fc563a723 |
| cip/5.10 | 3.10 | 5.10.268-cip77 | ed2f92ce2fc4 |
| cip/5.10-rt | 3.10 | 5.10.268-cip77-rt34 | ed2f92ce2fc4 |
| cip/6.1 | 3.10 | 6.1.187-cip60 | af62f1af182d |
| cip/6.1-rt | 3.10 | 6.1.189-cip61-rt32 | af62f1af182d |
| cip/6.12 | 3.10 | 6.12.104-cip30 | ed1161ab6239 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |