CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-03 · updated 2026-10-19
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage.

Affected products

Linux kernel: from 3.9 before 5.10.253; from 5.11 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10 — fixed in 5.10.253, 6.1.167, 6.12.78, 6.18.20, 6.19.10, 6.6.130

How to fix

Upgrade to a fixed version: Linux kernel 5.10.253, 6.1.167, 6.12.78, 6.18.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31403 or the next vulnerability affects your stack