CVE-2026-74730: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
In the Linux kernel, the following vulnerability has been resolved:
NFS: Pin the 'struct nfsserver' during a FREESTATEID call
Dan Aloni reports that he was able to hit a use-after-free bug if a FREESTATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfsserver' object for the duration of the FREESTATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
Which systems are potentially affected?
Linux kernel systems that perform NFS FREE_STATEID operations are potentially affected when such an operation is delayed and the associated struct nfs_server is cleaned up while it remains in flight.
What condition is needed to trigger the issue?
A FREE_STATEID operation must be delayed for some reason, allowing a race in which the struct nfs_server object can be freed before the operation completes.