High 7.8Published Apr 3, 2026

CVE-2026-31403NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

Updated under an hour ago (Oct 27, 2026, 2:23 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5 before 76740c28050dc6db2f5550f1325b00a11bbb3255; from 96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5 before c7f406fb341d6747634b8b1fa5461656e5e56076; from 96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5 before d1a19217995df9c7e4118f5a2820c5032fef2945; from 96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5 before e3d77f935639e6ae4b381c80464c31df998d61f4; from 96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5 before db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6; 96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5 builds before 6a8d70e2ad6aad2c345a5048edcb8168036f97d6; from 96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5 before e7fcf179b82d3a3730fd8615da01b087cc654d0b	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.9 before 5.10.253; from 5.11 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/76740c28050dc6db2f5550f1325b00a11bbb3255	patch
https://git.kernel.org/stable/c/c7f406fb341d6747634b8b1fa5461656e5e56076	patch
https://git.kernel.org/stable/c/d1a19217995df9c7e4118f5a2820c5032fef2945	patch
https://git.kernel.org/stable/c/e3d77f935639e6ae4b381c80464c31df998d61f4	patch
https://git.kernel.org/stable/c/db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6	patch
https://git.kernel.org/stable/c/6a8d70e2ad6aad2c345a5048edcb8168036f97d6	patch
https://git.kernel.org/stable/c/e7fcf179b82d3a3730fd8615da01b087cc654d0b	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.