CVE-2026-74730

CriticalCVSS 9.8/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009, < ed2f92ce2fc48463c41e0e540b9a3454889e8af8; >= 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009, < d858ab09e787106432d4d9830bad9dfedf02f890; >= 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009, < af62f1af182d33a0de38308c012841885d8ab92e; >= 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009, < caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd; >= 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009, < ed1161ab6239761958b38d5667225634fc2be894; >= 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009, < d71dfffa512e71b166a889484e4c3b148a9a3af2; >= 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009, < 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd; >= 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009, < cf616096a0f3a2b60f7d68b6b39674a6867ded9c
LinuxLinux3.10

References

Timeline

Published
Aug 22, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-747317.8In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-linked sub-schedulers ACVE-2026-747337.8In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is CVE-2026-74734In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in ar_context_release DurCVE-2026-74735In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seq_file release In pppoCVE-2026-747367.8In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different deviCVE-2026-747379.8In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG CVE-2026-74738In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readable_reg callback regmap_sdw_CVE-2026-747397.8In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enCVE-2026-74748.8HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. ThiCVE-2026-74740In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain tcf_action_CVE-2026-747417.5In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enablingCVE-2026-747427.5In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in veth_poll veth_poll
CVE-2026-74730: Critical severity, CVSS 9.8 | Vulnix