In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix possible badness in FREE_STATEID
When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors.
In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the lock before calling nfs4_put_stid(), that allows another FREE_STATE to find the stateid again. The first one will proceed to then free the stateid which leads to either use-after-free or decrementing already zeroed counter.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | May 13, 2026 | Oct 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-awsUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.11.0-1009-azureUpgrade linux-image-azureUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-virtualUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-oem-24.04aUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-6.11.0-1010-lowlatency | Feb 20, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub