CVE-2026-74730

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

State: Published
Severity: 9.8 Critical
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before ed2f92ce2fc48463c41e0e540b9a3454889e8af8Affected 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before d858ab09e787106432d4d9830bad9dfedf02f890Affected 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before af62f1af182d33a0de38308c012841885d8ab92eAffected 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before caee6a68ffaa5016dfc01cd0b3dc1896a32e3abdAffected 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before ed1161ab6239761958b38d5667225634fc2be894Affected 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before d71dfffa512e71b166a889484e4c3b148a9a3af2Affected 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before 80ed3d762628b36c9e4b22fac7c65b72ef3b13ddAffected 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before cf616096a0f3a2b60f7d68b6b39674a6867ded9cAffected
LinuxLinux	3.10Affected before 3.10Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before ed2f92ce2fc48463c41e0e540b9a3454889e8af8Affected
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before d858ab09e787106432d4d9830bad9dfedf02f890Affected
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before af62f1af182d33a0de38308c012841885d8ab92eAffected
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before caee6a68ffaa5016dfc01cd0b3dc1896a32e3abdAffected
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before ed1161ab6239761958b38d5667225634fc2be894Affected
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before d71dfffa512e71b166a889484e4c3b148a9a3af2Affected
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before 80ed3d762628b36c9e4b22fac7c65b72ef3b13ddAffected
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 to before cf616096a0f3a2b60f7d68b6b39674a6867ded9cAffected

LinuxLinux

3.10Affected
before 3.10Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.