{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Jiwoong Wi (Tobabz Team) for reporting this issue.", "bugzilla": {"description": "nfs-ganesha: nfs-ganesha: NFSv4.1 cached-READ session-slot replay causes double-free and use-after-free read", "id": "2563152", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563152"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-415", "details": ["A double-free and use-after-free vulnerability was found in NFS-Ganesha. When an NFSv4.1 COMPOUND request caches a READ reply in the session-slot replay cache, the READ data buffer is freed on first transmission but the cache retains a dangling pointer. A subsequent legal protocol replay re-sends the freed buffer contents to the client and frees the pointer again, resulting in remote heap information disclosure and a daemon crash."], "mitigation": {"lang": "en:us", "value": "Restricting NFS exports to Kerberos-only authentication (SecType = krb5/krb5i/krb5p) prevents unauthenticated exploitation, though authenticated clients can still trigger the bug. Network segmentation to restrict NFS port access reduces the attack surface."}, "name": "CVE-2026-123042", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Not affected", "package_name": "nfs-ganesha", "product_name": "Red Hat Ceph Storage 4"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Not affected", "package_name": "rhceph/rhceph-9-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Not affected", "package_name": "rhceph/rhceph-9-rhel9", "product_name": "Red Hat Ceph Storage 9"}], "public_date": "2026-10-28T19:51:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123042\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123042"], "statement": "Red Hat Ceph Storage 4 ships nfs-ganesha 3.5, which predates the introduction of the zero-copy iovec READ path in V6.0 (commit 48e5220b2) and is therefore not affected by this vulnerability.\nRed Hat Ceph Storage 9 ships nfs-ganesha versions V7.0 and later inside the rhceph container images, which include the vulnerable code path. The NFSv4.1 session-slot replay cache stores READ reply buffers by shallow pointer, allowing a legal protocol replay to re-encode freed heap memory and free the same buffer again. Exploitation requires only TCP reachability to the NFS port; on AUTH_SYS or AUTH_NONE exports no real credential is needed.", "threat_severity": "Important"}

{}