Junglewise Threat Intelligence

CVE-2026-31403: Linux Kernel NFSD use-after-free in /proc/fs/nfs/exports

CVE-2026-31403 · Severity: high · CVSS 7.8 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) server could allow a local user to crash the system or potentially execute unauthorized actions. The issue occurs when the system fails to properly track active connections to certain internal files, leading to a 'use-after-free' condition when a network container is destroyed. This could impact the stability and availability of servers hosting shared files, particularly in containerized environments.

Technical details

A use-after-free vulnerability exists in the Linux kernel's NFSD implementation within the nfsctl.c component. The function exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache but fails to take a reference on the namespace. If the namespace is torn down (e.g., during container destruction) while a file descriptor for /proc/fs/nfs/exports remains open, nfsd_net_exit() frees the cache. Subsequent reads on the open file descriptor dereference the freed cache_detail, leading to a kernel crash or potential privilege escalation. The fix involves holding a reference on the struct net for the lifetime of the open file descriptor to prevent premature cache destruction.

Affected products

  • Linux Linux Kernel 3.9 to 5.10.253, 5.11 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10

Timeline

  • 2026-02-19: other: Vulnerability fix authored
  • 2026-04-03: advisory: Initial disclosure and CVE assignment
  • 2026-04-03: patched: Patches merged into various stable kernel branches

References

Related threats