In the Linux kernel, the following vulnerability has been resolved:

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Dan Aloni reports that he was able to hit a use-after-free bug if a
FREE_STATEID operation gets delayed for whatever reason. Fix this by
bumping the refcount of the 'struct nfs_server' object for the duration
of the FREE_STATEID so it doesn't get cleaned up from underneath us
while operations are still in flight.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 affected < ed2f92ce2fc48463c41e0e540b9a3454889e8af8
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 affected < d858ab09e787106432d4d9830bad9dfedf02f890
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 affected < af62f1af182d33a0de38308c012841885d8ab92e
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 affected < caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 affected < ed1161ab6239761958b38d5667225634fc2be894
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 affected < d71dfffa512e71b166a889484e4c3b148a9a3af2
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 affected < 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 affected < cf616096a0f3a2b60f7d68b6b39674a6867ded9c
Linux Linux affected
Version Status Constraints
3.10 affected —
0 unaffected < 3.10
5.10.265 unaffected ≤ 5.10.*
5.15.216 unaffected ≤ 5.15.*
6.1.183 unaffected ≤ 6.1.*
6.6.152 unaffected ≤ 6.6.*
6.12.104 unaffected ≤ 6.12.*
6.18.45 unaffected ≤ 6.18.*
7.1.9 unaffected ≤ 7.1.*
7.2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd cve-icon
https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e cve-icon
https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd cve-icon
https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c cve-icon
https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2 cve-icon
https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890 cve-icon
https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894 cve-icon
https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8 cve-icon
History

Sat, 22 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
Title NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-22T15:33:19.659Z

Reserved: 2026-08-15T05:44:03.930Z

Link: CVE-2026-74730

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.