{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31404", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.086Z", "datePublished": "2026-04-03T15:16:07.207Z", "dateUpdated": "2026-04-03T15:16:07.207Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-03T15:16:07.207Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Defer sub-object cleanup in export put callbacks\n\nsvc_export_put() calls path_put() and auth_domain_put() immediately\nwhen the last reference drops, before the RCU grace period. RCU\nreaders in e_show() and c_show() access both ex_path (via\nseq_path/d_path) and ex_client->name (via seq_escape) without\nholding a reference. If cache_clean removes the entry and drops the\nlast reference concurrently, the sub-objects are freed while still\nin use, producing a NULL pointer dereference in d_path.\n\nCommit 2530766492ec (\"nfsd: fix UAF when access ex_uuid or\nex_stats\") moved kfree of ex_uuid and ex_stats into the\ncall_rcu callback, but left path_put() and auth_domain_put() running\nbefore the grace period because both may sleep and call_rcu\ncallbacks execute in softirq context.\n\nReplace call_rcu/kfree_rcu with queue_rcu_work(), which defers the\ncallback until after the RCU grace period and executes it in process\ncontext where sleeping is permitted. This allows path_put() and\nauth_domain_put() to be moved into the deferred callback alongside\nthe other resource releases. Apply the same fix to expkey_put(),\nwhich has the identical pattern with ek_path and ek_client.\n\nA dedicated workqueue scopes the shutdown drain to only NFSD\nexport release work items; flushing the shared\nsystem_unbound_wq would stall on unrelated work from other\nsubsystems. nfsd_export_shutdown() uses rcu_barrier() followed\nby flush_workqueue() to ensure all deferred release callbacks\ncomplete before the export caches are destroyed.\n\nReviwed-by: Jeff Layton <jlayton@kernel.org>"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/export.c", "fs/nfsd/export.h", "fs/nfsd/nfsctl.c"], "versions": [{"version": "c224edca7af028828e2ad866b61d731b5e72b46d", "lessThan": "2829e80d29b627886d12b5ea40856d56b516e67d", "status": "affected", "versionType": "git"}, {"version": "c224edca7af028828e2ad866b61d731b5e72b46d", "lessThan": "f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2", "status": "affected", "versionType": "git"}, {"version": "c224edca7af028828e2ad866b61d731b5e72b46d", "lessThan": "48db892356d6cb80f6942885545de4a6dd8d2a29", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/export.c", "fs/nfsd/export.h", "fs/nfsd/nfsctl.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0-rc5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.0-rc5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d"}, {"url": "https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2"}, {"url": "https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29"}], "title": "NFSD: Defer sub-object cleanup in export put callbacks", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Defer sub-object cleanup in export put callbacks\n\nsvc_export_put() calls path_put() and auth_domain_put() immediately\nwhen the last reference drops, before the RCU grace period. RCU\nreaders in e_show() and c_show() access both ex_path (via\nseq_path/d_path) and ex_client->name (via seq_escape) without\nholding a reference. If cache_clean removes the entry and drops the\nlast reference concurrently, the sub-objects are freed while still\nin use, producing a NULL pointer dereference in d_path.\n\nCommit 2530766492ec (\"nfsd: fix UAF when access ex_uuid or\nex_stats\") moved kfree of ex_uuid and ex_stats into the\ncall_rcu callback, but left path_put() and auth_domain_put() running\nbefore the grace period because both may sleep and call_rcu\ncallbacks execute in softirq context.\n\nReplace call_rcu/kfree_rcu with queue_rcu_work(), which defers the\ncallback until after the RCU grace period and executes it in process\ncontext where sleeping is permitted. This allows path_put() and\nauth_domain_put() to be moved into the deferred callback alongside\nthe other resource releases. Apply the same fix to expkey_put(),\nwhich has the identical pattern with ek_path and ek_client.\n\nA dedicated workqueue scopes the shutdown drain to only NFSD\nexport release work items; flushing the shared\nsystem_unbound_wq would stall on unrelated work from other\nsubsystems. nfsd_export_shutdown() uses rcu_barrier() followed\nby flush_workqueue() to ensure all deferred release callbacks\ncomplete before the export caches are destroyed.\n\nReviwed-by: Jeff Layton <jlayton@kernel.org>"}], "id": "CVE-2026-31404", "lastModified": "2026-04-03T16:16:39.643", "metrics": {}, "published": "2026-04-03T16:16:39.643", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c224edca7af028828e2ad866b61d731b5e72b46d,2829e80d29b627886d12b5ea40856d56b516e67d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c224edca7af028828e2ad866b61d731b5e72b46d,f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c224edca7af028828e2ad866b61d731b5e72b46d,48db892356d6cb80f6942885545de4a6dd8d2a29)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-03T18:52:25.548922+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a patched release that contains the fix commit 2530766492ec or later.", "If a kernel update is not immediately feasible, restrict or disable the NFS service to limit exposure until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Kernel Crash / Denial of Service"}, "threat_synthesis": {"affected_systems": "This flaw affects all deployments of the Linux kernel running the Network File System (NFS) server (nfsv4). No specific vendor or product version is listed, so any kernel built from upstream sources in which the commit is present is potentially impacted.", "description_and_impact": "The Linux kernel includes a use\u2011after\u2011free bug in the NFSD export put callbacks. If an NFS client is dropped while its export cache entry is still being accessed, the kernel may free the underlying path and client objects before the RCU grace period ends. This can lead to a NULL pointer dereference in d_path, causing a kernel panic. The flaw is a classic use\u2011after\u2011free error that can allow an attacker to crash the system or potentially execute code with kernel privileges.", "risk_and_exploitability": "The severity cannot be quantified in CVSS terms in the supplied data, but the vulnerability is exploitable remotely over the network via the NFS protocol. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers would need to interact with a vulnerable NFS server, and the bug is triggered during the cache invalidate path, so it requires a specially crafted request or concurrent client disconnect. Nonetheless, the bug grants a clear denial\u2011of\u2011service vector that can be used as part of a larger compromise."}}}}, "created": "2026-04-03T21:13:10.448569+00:00", "updated": "2026-04-03T21:15:22.719165+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}