{"id":"CVE-2026-74730","revision":"67449541e24c4bcbbe78c6e360eeae1b","records":[{"revision":"67449541e24c4bcbbe78c6e360eeae1b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74730","aliases":[],"title":"NFS: Pin the 'struct nfs_server' during a FREE_STATEID call","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Pin the 'struct nfs_server' during a FREE_STATEID call\n\nDan Aloni reports that he was able to hit a use-after-free bug if a\nFREE_STATEID operation gets delayed for whatever reason. Fix this by\nbumping the refcount of the 'struct nfs_server' object for the duration\nof the FREE_STATEID so it doesn't get cleaned up from underneath us\nwhile operations are still in flight.","state":0,"publishedAt":"2026-08-22T15:33:19.659+00:00","modifiedAt":"2026-10-16T19:16:12.405+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfs/nfs4proc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\n                            \"lessThan\": \"ed2f92ce2fc48463c41e0e540b9a3454889e8af8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\n                            \"lessThan\": \"d858ab09e787106432d4d9830bad9dfedf02f890\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\n                            \"lessThan\": \"af62f1af182d33a0de38308c012841885d8ab92e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\n                            \"lessThan\": \"caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\n                            \"lessThan\": \"ed1161ab6239761958b38d5667225634fc2be894\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\n                            \"lessThan\": \"d71dfffa512e71b166a889484e4c3b148a9a3af2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\n                            \"lessThan\": \"80ed3d762628b36c9e4b22fac7c65b72ef3b13dd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\n                            \"lessThan\": \"cf616096a0f3a2b60f7d68b6b39674a6867ded9c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfs/nfs4proc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.152\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.104\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.45\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.9\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8","https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890","https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e","https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd","https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894","https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2","https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd","https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74730","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74730","identifiers":["CVE-2026-74730"]},"retained":false,"historicalAffected":[]}],"coverage":[]}