CVE-2026-74730

A flaw was found in the Linux kernel's Network File System (NFS). This vulnerability involves improper memory handling where a critical data structure is released prematurely if a FREE_STATEID operation is delayed. This can lead to memory corruption, potentially causing system instability or a denial of service.

An asynchronous NFSv4 FREE_STATEID call could outlive the referenced struct nfs_server because the operation did not pin the NFS superblock for the lifetime of the in flight RPC. If the RPC is delayed while the mount or server state is being torn down, nfs41_free_stateid_release can dereference data server after it has been freed, creating a kernel use after free condition. For the CVSS the PR:L is used for the paranoid score because a local user with access to an existing NFSv4 mount may be able to generate stateid create and release activity, while reliable triggering still depends on timing and mount teardown behavior. The issue is not directly network reachable by arbitrary inbound packets, but a malicious or compromised NFS server can increase practical risk by delaying FREE_STATEID replies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.