CVE-2026-31403

A flaw was found in the Linux kernel's Network File System Daemon (NFSD) component. A local user can exploit this vulnerability by opening the /proc/fs/nfs/exports file and then causing the associated network namespace to be destroyed. Subsequent attempts to read from the still-open file descriptor will lead to dereferencing freed memory, which can result in a system crash or a Denial of Service (DoS).

exports_proc_open() cached export cache without pinning struct net. After namespace teardown, nfsd_export_shutdown() freed the cache while the fd remained open. Holding a net reference for the fd lifetime prevents the UAF. Relevant to NFS server and container or namespace workflows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.