CVE-2026-74730— NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： NFS：在 FREE_STATEID 调用期间锁定 对象 Dan Aloni 报告称，如果 FREE_STATEID 操作因任何原因被延迟，他能够触发一个使用后释放（use-after-free）漏洞。为此，通过在 FREE_STATEID 操作的整个执行期间增加 对象的引用计数，防止其在操作尚未完成时被意外清理，从而修复此问题。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009< ed2f92ce2fc48463c41e0e540b9a3454889e8af8 |
affected |
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009< d858ab09e787106432d4d9830bad9dfedf02f890 |
affected | ||
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009< af62f1af182d33a0de38308c012841885d8ab92e |
affected | ||
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009< caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd |
affected | ||
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009< ed1161ab6239761958b38d5667225634fc2be894 |
affected | ||
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009< d71dfffa512e71b166a889484e4c3b148a9a3af2 |
affected | ||
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009< 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd |
affected | ||
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009< cf616096a0f3a2b60f7d68b6b39674a6867ded9c |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74730
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Dan Aloni reports that he was able to hit a use-after-free bug if a
FREE_STATEID operation gets delayed for whatever reason. Fix this by
bumping the refcount of the 'struct nfs_server' object for the duration
of the FREE_STATEID so it doesn't get cleaned up from underneath us
while operations are still in flight.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74730
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74730
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74730 (8)
Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total
| CVE-2026-74638 | drm/v3d: Serialize the scheduler timeout handlers | |
| CVE-2026-74621 | net/sched: act_ct: fix sk_buff leak when the header checks reject a packet | |
| CVE-2026-74622 | net: atlantic: free RX pages of consumed but not refilled buffers | |
| CVE-2026-74623 | net: atlantic: free stranded TX buffers on ring deinit | |
| CVE-2026-74624 | netfilter: nf_conntrack: defer invalid log until after unlock | |
| CVE-2026-74625 | netfilter: bridge: release template ct on non-IP path | |
| CVE-2026-74627 | net: devmem: prevent net-iov / page mixing | |
| CVE-2026-74626 | NTB: ntb_netdev: Preserve RX queue depth on allocation failure | |
| CVE-2026-74628 | net/x25: fix use-after-free of the socket by its timers | |
| CVE-2026-74629 | net/dibs: Correct freeing of dmb_clientid_arr | |
| CVE-2026-74631 | net: smc: fix splice entry lifetime imbalance in smc_rx_splice | |
| CVE-2026-74630 | ipv6: prevent in6_dev_get() from resurrecting inet6_dev | |
| CVE-2026-74632 | mm/huge_memory: fix huge_zero_pfn race | |
| CVE-2026-74633 | tracing: Fix NULL pointer dereference in module event cache removal | |
| CVE-2026-74634 | ring-buffer: Prevent subbuf order change when resizing is disabled | |
| CVE-2026-74635 | fbdev: bitblit: bound-check glyph index in bit_cursor() | |
| CVE-2026-74636 | tracing: Fix race between update_event_fields and, event_define_fields | |
| CVE-2026-74637 | perf/core: Fix group leader use-after-free after sibling detach | |
| CVE-2026-74639 | ALSA: us144mkii: re-anchor capture URBs on resubmission | |
| CVE-2026-74650 | staging: rtl8723bs: fix OOB read in WMM_param_handler() |
Showing top 20 of 150 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_ -
CVE-2026-74727
ovpn: skip rehash for peers already removed from by_id
Same vendor: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_ -
CVE-2026-74727
ovpn: skip rehash for peers already removed from by_id
V. Comments for CVE-2026-74730
No comments yet