SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-74730

CRITICAL · CVSS 9.8 EPSS 0.51%

Source: NVD + CISA KEV + EPSS · Published 2026-08-22 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

A use-after-free vulnerability in the Linux kernel's NFS implementation can occur during a delayed FREE_STATEID operation, potentially leading to system instability or crashes. This issue affects systems utilizing NFS, particularly those that rely on the kernel's handling of state IDs. Administrators of Linux servers and applications using NFS should prioritize applying the relevant patches to mitigate this risk.

CVE
CVE-2026-74730
Severity
CRITICAL
CVSS
9.8
EPSS
0.51%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.