CVE-2026-74730 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel's Network File System implementation contains a critical concurrency flaw related to reference counting and state management during client-server interactions. Specifically, this vulnerability affects the handling of NFSv4 FREE_STATEID operations, which are used by clients to release previously acquired file locks or delegation states back to the server. The core issue arises when a FREE_STATEID request is delayed in transmission or processing due to network latency, congestion, or other system conditions. During such delays, if the local reference count for the associated struct nfs_server object drops to zero because no other active operations are holding it, the kernel may proceed to free and destroy this structure from memory. However, the pending FREE_STATEID operation still holds a logical pointer to that now-freed server context. When the delayed operation finally executes or attempts to access its target data structures, it dereferences an invalid memory address, resulting in a use-after-free condition. This scenario highlights a race condition where the lifecycle of the server structure is not properly synchronized with the asynchronous nature of network operations involving state IDs.
From a technical perspective, this vulnerability stems from insufficient reference counting mechanisms within the NFS client code path responsible for managing lease and delegation states. The struct nfs_server object represents significant kernel resources including connection sockets, cache structures, and security contexts. When an operation like FREE_STATEID is initiated, it assumes that the server structure will remain valid until the operation completes or times out. Without explicitly pinning this structure by incrementing its reference count before sending the request, there exists a window of time where concurrent cleanup routines can deallocate the memory while the operation remains in flight. This violates fundamental kernel safety principles regarding object lifetime management during asynchronous I/O operations. The flaw allows for potential kernel crashes leading to denial of service or, more severely, arbitrary code execution if an attacker can control the data written into the freed memory region before it is reallocated for other purposes.
The operational impact of this vulnerability includes system instability and potential security breaches on affected Linux systems running vulnerable NFS client configurations. A local user with appropriate privileges could potentially trigger conditions that delay FREE_STATEID operations, such as manipulating network interfaces or creating heavy I/O loads to induce scheduling delays. Successful exploitation could lead to kernel panics causing service outages for all users relying on the NFS mount points involved. In more sophisticated attack scenarios involving remote code execution capabilities through memory corruption techniques like heap spraying, an attacker might gain elevated privileges within the compromised system. This is particularly dangerous in enterprise environments where NFS servers host critical shared data and multiple clients interact with them concurrently under varying network conditions that could naturally induce such delays without malicious intent.
Mitigation strategies primarily involve applying kernel patches provided by distribution vendors that implement proper reference counting for struct nfs_server during FREE_STATEID operations. Administrators should ensure their systems are updated to versions where the NFS client code explicitly increments and decrements server structure references around asynchronous state management calls. Additionally, monitoring network latency on NFS mounts can help identify environments prone to triggering this race condition due to poor connectivity. For organizations unable to patch immediately, reducing the frequency of delegation releases or adjusting lease timeout values may reduce exposure windows, though these are temporary workarounds rather than definitive fixes. Long-term resilience requires adherence to secure coding practices that enforce strict object lifetime management for all kernel structures involved in network protocol state machines, ensuring no operation proceeds without guaranteed resource availability.
This vulnerability aligns with Common Weakness Enumeration category CWE-416 which describes use-after-free errors resulting from improper memory management and reference counting failures. In terms of attack vector classification under MITRE ATT&CK framework, this falls under techniques involving exploitation of software vulnerabilities for privilege escalation or denial of service depending on the outcome achieved by an attacker leveraging the race condition. The specific context relates to client-side state machine handling within distributed file systems emphasizing the importance of robust synchronization primitives in networked kernel subsystems. Security teams should prioritize patching affected NFS clients especially those exposed over untrusted networks where attackers might attempt to manipulate timing conditions to exploit this flaw effectively against production infrastructure relying on stable and secure file sharing protocols.