Critical 9.8Published Aug 22, 2026

CVE-2026-74730NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Updated under an hour ago (Oct 27, 2026, 3:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 before ed2f92ce2fc48463c41e0e540b9a3454889e8af8; from 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 before d858ab09e787106432d4d9830bad9dfedf02f890; from 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 before af62f1af182d33a0de38308c012841885d8ab92e; from 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 before caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd; from 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 before ed1161ab6239761958b38d5667225634fc2be894; from 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 before d71dfffa512e71b166a889484e4c3b148a9a3af2; from 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 before 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd; from 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 before cf616096a0f3a2b60f7d68b6b39674a6867ded9c	CNA record

References

References

https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8
https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890
https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e
https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd
https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894
https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2
https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd
https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.