Linux kernel NFSD: reads on an open /proc/fs/nfs/exports fd walk a freed export cache after netns teardown

Impact

exports_proc_open() stored the caller's network-namespace svc_export_cache in seq->private without taking a reference on the namespace. If that namespace is torn down afterwards - the described case is a container being destroyed after the opener has setns()'d elsewhere - nfsd_net_exit() calls nfsd_export_shutdown() and frees the cache, and a later read on the still-open fd dereferences the freed cache_detail and walks a freed hash table. On a cluster whose storage path is kernel NFS exports, that is a use-after-free in the host kernel reachable by holding one procfs fd across a container's lifetime; the consequence is memory corruption on the file server or storage node, which in practice means an unplanned reboot of a node many jobs depend on.

Who can reach it

Local user on a host running knfsd who can open /proc/fs/nfs/exports inside a network namespace, move to another namespace, and read the fd after the first namespace is destroyed. Needs read access to that procfs entry and the ability to enter or create a netns; no remote NFS client path is involved.

What to do

Update the kernel on NFS server nodes to a build carrying the stable fix commits below (holding a struct net reference for the lifetime of the open fd) and reboot each one - NFSD is built in or loaded on the serving path, so this is a node reboot with clients failing over or stalling. Only hosts running the in-kernel NFS server are affected; NFS clients are not.

References

Related entries

• Linux kernel (net/xfrm): Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after itCVE-2026-31406 · Linux kernel (net/xfrm)High
• Linux kernel (crypto algif_aead): Incorrect resource transfer between spheres in algif_aead (reverted to out-of-placeCVE-2026-31431 · Linux kernel (crypto algif_aead)High
• Linux kernel idxd: stale saved-config pointer after a failed second FLR allows invalid memory accessCVE-2026-31442 · Linux kernel dmaengine idxd (saved-config scratch area after FLR)High
• Linux kernel (drivers/vfio/pci): The error path of the vfio-pci dma-buf export falls through the whole unwind chainCVE-2026-31468 · Linux kernel (drivers/vfio/pci)High
• Linux kernel (net/smc): Tee(2) duplicates an SMC splice pipe buffer without duplicating the private state hanging offCVE-2026-31507 · Linux kernel (net/smc)High
• Linux kernel (net/xfrm): An XFRM_MSG_NEWSPDINFO request queues a per-namespace work item on the global systemCVE-2026-31516 · Linux kernel (net/xfrm)High