CVE-2026-31403
NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage.
INFO
Published Date :
April 3, 2026, 4:16 p.m.
Last Modified :
July 24, 2026, 10:10 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Apply the specific patch addressing the NFSD vulnerability.
- Reboot the system after applying the kernel update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31403.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31403 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31403
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31403 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31403 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: NFSD: Mantener la referencia de red durante la vida útil del fd /proc/fs/nfs/exports La entrada proc /proc/fs/nfs/exports se crea en la inicialización del módulo y persiste durante la vida útil del módulo. exports_proc_open() captura el espacio de nombres de red actual del llamador y almacena su svc_export_cache en seq -> private, pero no toma ninguna referencia sobre el espacio de nombres. Si el espacio de nombres se desmantela posteriormente (p. ej., destrucción del contenedor después de que el abridor haga setns() a un espacio de nombres diferente), nfsd_net_exit() llama a nfsd_export_shutdown() que libera la caché. Lecturas posteriores en el fd aún abierto desreferencian el cache_detail liberado, recorriendo una tabla hash liberada. Mantener una referencia sobre la struct net durante la vida útil del descriptor de archivo abierto. Esto evita que nfsd_net_exit() se ejecute -- y por lo tanto evita que nfsd_export_shutdown() libere la caché -- mientras cualquier fd de exportaciones esté abierto. cache_detail ya almacena su puntero de red (cd -> net, establecido por cache_create_net()), por lo que exports_release() puede recuperarlo sin almacenamiento adicional por archivo. -
CVE Modified by 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Jul. 14, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIPLUS S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIPLUS S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}] Added Reference https://cert-portal.siemens.com/productcert/html/ssa-019113.html Added Reference https://cert-portal.siemens.com/productcert/html/ssa-082556.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5', 'lessThan': '76740c28050dc6db2f5550f1325b00a11bbb3255', 'versionType': 'git'}, {'status': 'affected', 'version': '96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5', 'lessThan': 'c7f406fb341d6747634b8b1fa5461656e5e56076', 'versionType': 'git'}, {'status': 'affected', 'version': '96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5', 'lessThan': 'd1a19217995df9c7e4118f5a2820c5032fef2945', 'versionType': 'git'}, {'status': 'affected', 'version': '96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5', 'lessThan': 'e3d77f935639e6ae4b381c80464c31df998d61f4', 'versionType': 'git'}, {'status': 'affected', 'version': '96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5', 'lessThan': 'db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6', 'versionType': 'git'}, {'status': 'affected', 'version': '96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5', 'lessThan': '6a8d70e2ad6aad2c345a5048edcb8168036f97d6', 'versionType': 'git'}, {'status': 'affected', 'version': '96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5', 'lessThan': 'e7fcf179b82d3a3730fd8615da01b087cc654d0b', 'versionType': 'git'}], 'programFiles': ['fs/nfsd/nfsctl.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.253', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '6.1.167', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.130', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.78', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.20', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '6.19.10', 'versionType': 'semver', 'lessThanOrEqual': '6.19.*'}, {'status': 'unaffected', 'version': '7.0', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/nfsd/nfsctl.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
May. 20, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.130 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.78 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.20 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.9 up to (excluding) 5.10.253 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 6.1.167 Added Reference Type kernel.org: https://git.kernel.org/stable/c/6a8d70e2ad6aad2c345a5048edcb8168036f97d6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/76740c28050dc6db2f5550f1325b00a11bbb3255 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c7f406fb341d6747634b8b1fa5461656e5e56076 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d1a19217995df9c7e4118f5a2820c5032fef2945 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e3d77f935639e6ae4b381c80464c31df998d61f4 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e7fcf179b82d3a3730fd8615da01b087cc654d0b Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 18, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/76740c28050dc6db2f5550f1325b00a11bbb3255 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 03, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage. Added Reference https://git.kernel.org/stable/c/6a8d70e2ad6aad2c345a5048edcb8168036f97d6 Added Reference https://git.kernel.org/stable/c/c7f406fb341d6747634b8b1fa5461656e5e56076 Added Reference https://git.kernel.org/stable/c/d1a19217995df9c7e4118f5a2820c5032fef2945 Added Reference https://git.kernel.org/stable/c/db4a9f99b12a7ee1c19d86c83a3b752c7effa6c6 Added Reference https://git.kernel.org/stable/c/e3d77f935639e6ae4b381c80464c31df998d61f4 Added Reference https://git.kernel.org/stable/c/e7fcf179b82d3a3730fd8615da01b087cc654d0b