Use-After-Free Vulnerability in Linux Kernel's NFS Module

CVE-2026-74730

What is CVE-2026-74730?

A use-after-free vulnerability in the Linux kernel's NFS module can arise during a FREE_STATEID operation if this operation is delayed. Dan Aloni discovered that during this delay, the 'struct nfs_server' could be prematurely cleaned up, creating a potential for exploitation. The vulnerability has been addressed by implementing a mechanism to increment the reference count of the 'struct nfs_server' during the duration of the FREE_STATEID process, thus preventing it from being deallocated at an unsafe moment.

References