CVE-2026-31404
Description
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Defer sub-object cleanup in export put callbacks
svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. If cache_clean removes the entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path.
Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or ex_stats") moved kfree of ex_uuid and ex_stats into the call_rcu callback, but left path_put() and auth_domain_put() running before the grace period because both may sleep and call_rcu callbacks execute in softirq context.
Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the callback until after the RCU grace period and executes it in process context where sleeping is permitted. This allows path_put() and auth_domain_put() to be moved into the deferred callback alongside the other resource releases. Apply the same fix to expkey_put(), which has the identical pattern with ek_path and ek_client.
A dedicated workqueue scopes the shutdown drain to only NFSD export release work items; flushing the shared system_unbound_wq would stall on unrelated work from other subsystems. nfsd_export_shutdown() uses rcu_barrier() followed by flush_workqueue() to ensure all deferred release callbacks complete before the export caches are destroyed.
Reviwed-by: Jeff Layton <jlayton@kernel.org>
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A use-after-free in the Linux kernel's NFSD export/expkey cache due to path and auth domain being freed before RCU grace period ends.
Vulnerability
Description
CVE-2026-31404 is a use-after-free vulnerability in the Linux kernel's NFS daemon (NFSD). The root cause lies in the svc_export_put() and expkey_put() callback functions, which release sub-objects (ex_path and ex_client->name via path_put() and auth_domain_put()) immediately when the last reference drops, before the RCU grace period completes. RCU readers in e_show() and c_show() access these same sub-objects without holding a separate reference, leading to a NULL pointer dereference in d_path when concurrent cache cleanup frees the objects while still in use [1].
Exploitation
An attacker would need to trigger a race condition between an RCU read-side critical section (e.g., via a proc filesystem read) and a concurrent cache entry removal that drops the last reference. This requires local access to the NFSD export tables, typically through the /proc/fs/nfsd/exports or /proc/net/rpc/nfsd.fh/channel interfaces. The vulnerability does not require authentication beyond standard file system permissions, and the attack surface is limited to systems where NFSD is actively managing exports [2].
Impact
Successful exploitation results in a kernel NULL pointer dereference, leading to a denial of service (system crash or hang). The CVSS v3 score of 7.8 (High) reflects the high availability impact. There is no evidence that this can be leveraged for privilege escalation or arbitrary code execution, as the bug only manifests as a memory access violation when the freed path or auth domain is accessed [3].
Mitigation
The fix replaces call_rcu/kfree_rcu with queue_rcu_work(), deferring all sub-object cleanup (including path_put() and auth_domain_put()) to a dedicated workqueue that runs in process context after the RCU grace period. Patches have been backported to stable kernel trees; all users should update to a kernel containing the fix. NFSD administrators may also consider restricting access to export-related proc files as a temporary workaround [1][3].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.