Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2026-31404 on 11 August 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
WITHDRAWN
CVE-2026-31404
NFSD: Defer sub-object cleanup in export put callbacks
Overview
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Details
INFO
Published Date :
April 3, 2026, 4:16 p.m.
Last Modified :
Aug. 11, 2026, 3:17 a.m.
Remotely Exploit :
—
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31404 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31404 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 11, 2026
Action Type Old Value New Value Changed Description In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer sub-object cleanup in export put callbacks svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. If cache_clean removes the entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path. Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or ex_stats") moved kfree of ex_uuid and ex_stats into the call_rcu callback, but left path_put() and auth_domain_put() running before the grace period because both may sleep and call_rcu callbacks execute in softirq context. Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the callback until after the RCU grace period and executes it in process context where sleeping is permitted. This allows path_put() and auth_domain_put() to be moved into the deferred callback alongside the other resource releases. Apply the same fix to expkey_put(), which has the identical pattern with ek_path and ek_client. A dedicated workqueue scopes the shutdown drain to only NFSD export release work items; flushing the shared system_unbound_wq would stall on unrelated work from other subsystems. nfsd_export_shutdown() uses rcu_barrier() followed by flush_workqueue() to ensure all deferred release callbacks complete before the export caches are destroyed. Reviwed-by: Jeff Layton <[email protected]> Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed CVSS V3.1 kernel.org: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Removed CWE NIST: CWE-476 Removed CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.14 up to (excluding) 6.18.20 Removed Reference kernel.org: https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d Removed Reference kernel.org: https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29 Removed Reference kernel.org: https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2 Removed Reference Type kernel.org: https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d Types: Patch Removed Reference Type kernel.org: https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29 Types: Patch Removed Reference Type kernel.org: https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2 Types: Patch Removed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'c224edca7af028828e2ad866b61d731b5e72b46d', 'lessThan': '2829e80d29b627886d12b5ea40856d56b516e67d', 'versionType': 'git'}, {'status': 'affected', 'version': 'c224edca7af028828e2ad866b61d731b5e72b46d', 'lessThan': 'f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2', 'versionType': 'git'}, {'status': 'affected', 'version': 'c224edca7af028828e2ad866b61d731b5e72b46d', 'lessThan': '48db892356d6cb80f6942885545de4a6dd8d2a29', 'versionType': 'git'}], 'programFiles': ['fs/nfsd/export.c', 'fs/nfsd/export.h', 'fs/nfsd/nfsctl.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.20', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '6.19.10', 'versionType': 'semver', 'lessThanOrEqual': '6.19.*'}, {'status': 'unaffected', 'version': '7.0', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/nfsd/export.c', 'fs/nfsd/export.h', 'fs/nfsd/nfsctl.c'], 'defaultStatus': 'affected'}] -
CVE Rejected by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 11, 2026
Action Type Old Value New Value -
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: NFSD: Aplazar la limpieza de subobjetos en las retrollamadas de liberación de exportación svc_export_put() llama a path_put() y auth_domain_put() inmediatamente cuando la última referencia se elimina, antes del período de gracia de RCU. Los lectores de RCU en e_show() y c_show() acceden tanto a ex_path (a través de seq_path/d_path) como a ex_client -> name (a través de seq_escape) sin mantener una referencia. Si cache_clean elimina la entrada y elimina la última referencia concurrentemente, los subobjetos son liberados mientras aún están en uso, produciendo una desreferenciación de puntero NULL en d_path. El Commit 2530766492ec ('nfsd: corregir UAF al acceder a ex_uuid o ex_stats') movió kfree de ex_uuid y ex_stats a la retrollamada call_rcu, pero dejó path_put() y auth_domain_put() ejecutándose antes del período de gracia porque ambos pueden entrar en suspensión y las retrollamadas call_rcu se ejecutan en contexto de softirq. Reemplazar call_rcu/kfree_rcu con queue_rcu_work(), lo que aplaza la retrollamada hasta después del período de gracia de RCU y la ejecuta en contexto de proceso donde se permite la suspensión. Esto permite que path_put() y auth_domain_put() sean movidos a la retrollamada aplazada junto con las otras liberaciones de recursos. Aplicar la misma corrección a expkey_put(), que tiene el patrón idéntico con ek_path y ek_client. Una cola de trabajo dedicada limita el alcance del vaciado de apagado solo a los elementos de trabajo de liberación de exportación de NFSD; vaciar la system_unbound_wq compartida se detendría en trabajo no relacionado de otros subsistemas. nfsd_export_shutdown() usa rcu_barrier() seguido de flush_workqueue() para asegurar que todas las retrollamadas de liberación aplazadas se completen antes de que se destruyan las cachés de exportación. Revisado por: Jeff Layton <[email protected]> -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'c224edca7af028828e2ad866b61d731b5e72b46d', 'lessThan': '2829e80d29b627886d12b5ea40856d56b516e67d', 'versionType': 'git'}, {'status': 'affected', 'version': 'c224edca7af028828e2ad866b61d731b5e72b46d', 'lessThan': 'f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2', 'versionType': 'git'}, {'status': 'affected', 'version': 'c224edca7af028828e2ad866b61d731b5e72b46d', 'lessThan': '48db892356d6cb80f6942885545de4a6dd8d2a29', 'versionType': 'git'}], 'programFiles': ['fs/nfsd/export.c', 'fs/nfsd/export.h', 'fs/nfsd/nfsctl.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.20', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '6.19.10', 'versionType': 'semver', 'lessThanOrEqual': '6.19.*'}, {'status': 'unaffected', 'version': '7.0', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/nfsd/export.c', 'fs/nfsd/export.h', 'fs/nfsd/nfsctl.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
May. 20, 2026
Action Type Old Value New Value Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.14 up to (excluding) 6.18.20 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 03, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer sub-object cleanup in export put callbacks svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. If cache_clean removes the entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path. Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or ex_stats") moved kfree of ex_uuid and ex_stats into the call_rcu callback, but left path_put() and auth_domain_put() running before the grace period because both may sleep and call_rcu callbacks execute in softirq context. Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the callback until after the RCU grace period and executes it in process context where sleeping is permitted. This allows path_put() and auth_domain_put() to be moved into the deferred callback alongside the other resource releases. Apply the same fix to expkey_put(), which has the identical pattern with ek_path and ek_client. A dedicated workqueue scopes the shutdown drain to only NFSD export release work items; flushing the shared system_unbound_wq would stall on unrelated work from other subsystems. nfsd_export_shutdown() uses rcu_barrier() followed by flush_workqueue() to ensure all deferred release callbacks complete before the export caches are destroyed. Reviwed-by: Jeff Layton <[email protected]> Added Reference https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d Added Reference https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29 Added Reference https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.