CVE-2026-31403

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

The /proc/fs/nfs/exports proc entry is created at module init

and persists for the module's lifetime. exports_proc_open()

captures the caller's current network namespace and stores

its svc_export_cache in seq->private, but takes no reference

on the namespace. If the namespace is subsequently torn down

(e.g. container destruction after the opener does setns() to a

different namespace), nfsd_net_exit() calls nfsd_export_shutdown()

which frees the cache. Subsequent reads on the still-open fd

dereference the freed cache_detail, walking a freed hash table.

Hold a reference on the struct net for the lifetime of the open

file descriptor. This prevents nfsd_net_exit() from running --

and thus prevents nfsd_export_shutdown() from freeing the cache

-- while any exports fd is open. cache_detail already stores

its net pointer (cd->net, set by cache_create_net(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References