{"id":"CVE-2026-31403","revision":"8e9ca5ba26ec471a85a46776b0cc7f6c","records":[{"revision":"8e9ca5ba26ec471a85a46776b0cc7f6c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31403","aliases":[],"title":"NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd\n\nThe /proc/fs/nfs/exports proc entry is created at module init\nand persists for the module's lifetime. exports_proc_open()\ncaptures the caller's current network namespace and stores\nits svc_export_cache in seq->private, but takes no reference\non the namespace. If the namespace is subsequently torn down\n(e.g. container destruction after the opener does setns() to a\ndifferent namespace), nfsd_net_exit() calls nfsd_export_shutdown()\nwhich frees the cache. Subsequent reads on the still-open fd\ndereference the freed cache_detail, walking a freed hash table.\n\nHold a reference on the struct net for the lifetime of the open\nfile descriptor. This prevents nfsd_net_exit() from running --\nand thus prevents nfsd_export_shutdown() from freeing the cache\n-- while any exports fd is open. cache_detail already stores\nits net pointer (cd->net, set by cache_create_net()), so\nexports_release() can retrieve it without additional per-file\nstorage.","state":0,"publishedAt":"2026-04-03T15:16:06.444+00:00","modifiedAt":"2026-10-19T18:35:46.952+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfsd/nfsctl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5\",\n                            \"lessThan\": \"76740c28050dc6db2f5550f1325b00a11bbb3255\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5\",\n                            \"lessThan\": \"c7f406fb341d6747634b8b1fa5461656e5e56076\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5\",\n                            \"lessThan\": \"d1a19217995df9c7e4118f5a2820c5032fef2945\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5\",\n                            \"lessThan\": \"e3d77f935639e6ae4b381c80464c31df998d61f4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5\",\n                            \"lessThan\": \"db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5\",\n                            \"lessThan\": \"6a8d70e2ad6aad2c345a5048edcb8168036f97d6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5\",\n                            \"lessThan\": \"e7fcf179b82d3a3730fd8615da01b087cc654d0b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfsd/nfsctl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.253\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.167\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.130\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.78\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.20\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.10\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/76740c28050dc6db2f5550f1325b00a11bbb3255","https://git.kernel.org/stable/c/c7f406fb341d6747634b8b1fa5461656e5e56076","https://git.kernel.org/stable/c/d1a19217995df9c7e4118f5a2820c5032fef2945","https://git.kernel.org/stable/c/e3d77f935639e6ae4b381c80464c31df998d61f4","https://git.kernel.org/stable/c/db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6","https://git.kernel.org/stable/c/6a8d70e2ad6aad2c345a5048edcb8168036f97d6","https://git.kernel.org/stable/c/e7fcf179b82d3a3730fd8615da01b087cc654d0b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31403","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31403","identifiers":["CVE-2026-31403"]},"retained":false,"historicalAffected":[]}],"coverage":[]}