CVE-2026-74730 Overview
CVE-2026-74730 is a use-after-free vulnerability in the Linux kernel's Network File System (NFS) client implementation. The flaw resides in the handling of FREE_STATEID operations, where the struct nfs_server object could be released while an operation was still in flight. Reporter Dan Aloni demonstrated the condition by delaying a FREE_STATEID call, which triggered access to freed memory. Maintainers resolved the issue by bumping the reference count of the struct nfs_server for the duration of the operation.
Critical Impact
Network-reachable use-after-free in the NFS client can lead to kernel memory corruption, potential privilege escalation, and denial of service on affected Linux systems.
Affected Products
- Linux kernel versions containing the vulnerable NFS FREE_STATEID code path prior to the referenced stable commits
- Distributions shipping the affected kernel builds with NFSv4 client support enabled
- Systems mounting NFSv4 shares where stateid lifecycle events can be delayed
Discovery Timeline
- Vulnerability reported by Dan Aloni
- 2026-08-22 - CVE-2026-74730 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74730
Vulnerability Analysis
The vulnerability is a use-after-free [CWE-416] in the Linux NFS client. The FREE_STATEID operation is issued to release a stateid on the NFS server when the client no longer needs it. During normal execution, the associated struct nfs_server object is expected to remain valid until the RPC completes.
When the FREE_STATEID RPC is delayed, for example by network latency or scheduling, the containing struct nfs_server can be torn down before the operation returns. The completion path then dereferences memory that has already been freed. This leads to kernel memory corruption, potentially allowing an attacker to influence kernel data structures.
Because the attack vector is network-based and requires no authentication or user interaction, systems mounting NFS shares from untrusted or attacker-influenced servers are exposed. Successful exploitation can compromise confidentiality, integrity, and availability of the affected host.
Root Cause
The root cause is missing lifetime management on the struct nfs_server reference used by in-flight FREE_STATEID RPCs. The code path did not hold a reference on the server object for the duration of the asynchronous operation. When cleanup ran before completion, the object was freed while still referenced.
Attack Vector
An attacker positioned on the network path between an NFS client and server can influence the timing of FREE_STATEID responses. A malicious or compromised NFS server can delay or reorder replies to trigger the race window. Exploitation targets kernel memory, so the outcome ranges from a crash to potential code execution in kernel context.
No verified public exploit code is available. Refer to the upstream commits 80ed3d7 and d858ab0 for the corrective changes.
Detection Methods for CVE-2026-74730
Indicators of Compromise
- Unexpected kernel oops or panic entries referencing nfs4_free_stateid, nfs_server, or NFSv4 RPC completion callbacks
- KASAN reports flagging use-after-free access on NFS client structures
- Sudden NFS client instability correlated with connections to unfamiliar or long-latency NFS servers
Detection Strategies
- Monitor kernel logs (dmesg, journalctl -k) for stack traces originating in the NFSv4 stateid release path
- Enable KASAN on test kernels to surface use-after-free conditions during NFS workload testing
- Inventory hosts running vulnerable kernel versions with active NFSv4 mounts and correlate against patch state
Monitoring Recommendations
- Alert on NFS mounts established with untrusted or externally routed NFS servers
- Track kernel crash telemetry across the fleet and pivot on repeated NFS-related faults
- Capture EDR process and kernel telemetry from Linux endpoints to identify anomalous NFS client behavior
How to Mitigate CVE-2026-74730
Immediate Actions Required
- Apply distribution kernel updates that include the upstream fix as soon as vendor packages are available
- Restrict NFS client connections to trusted, authenticated NFS servers on isolated network segments
- Reboot affected systems after patching to load the corrected kernel image
Patch Information
The fix bumps the refcount of struct nfs_server for the duration of the FREE_STATEID call so the object cannot be freed while the RPC is in flight. Corrective changes are available in the mainline and stable trees under commits 80ed3d7, af62f1a, caee6a6, cf61609, d71dffa, d858ab0, ed1161a, and ed2f92c. Consult your Linux distribution advisory for the corresponding backported package.
Workarounds
- Disable NFSv4 client functionality on hosts that do not require it until patched kernels are deployed
- Segment NFS traffic behind firewalls and permit only vetted NFS servers to communicate with clients
- Use network policy to block outbound NFS traffic to untrusted networks and enforce mount-time server allowlists
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
