CVE-2026-31403: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31403 is a use-after-free vulnerability in the Linux kernel's NFSD subsystem affecting the /proc/fs/nfs/exports file descriptor handling. When exports_proc_open() captures the caller's current network namespace without holding a reference to it, subsequent destruction of that namespace (e.g., container teardown) causes nfsd_export_shutdown() to free the export cache while the file descriptor remains open — leading to dereferences of freed memory. The vulnerability affects Linux kernel versions from 3.9 through multiple stable branches, with fixed versions at 5.10.253, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0-rc5. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a missing reference count on the struct net (network namespace) object captured during exports_proc_open(), classified as CWE-416 (Use After Free). When the namespace is torn down — for example, after a process calls setns() to switch namespaces and the original container is destroyed — nfsd_net_exit() invokes nfsd_export_shutdown(), which frees the svc_export_cache stored in seq->private. Any subsequent read() on the still-open file descriptor dereferences the freed cache_detail structure and walks a freed hash table, enabling memory corruption. The fix holds a reference on struct net for the lifetime of the open file descriptor and releases it in exports_release() using the net pointer already stored in cd->net (GitHub Advisory).

Successful exploitation allows a local attacker with read access to /proc/fs/nfs/exports to read from and potentially write to freed kernel memory, enabling arbitrary code execution with kernel privileges. This results in full confidentiality, integrity, and availability compromise of the affected system. In containerized environments, the attack could facilitate container escape or lateral movement to the host kernel (GitHub Advisory, Feedly).

1. Gain local access: Obtain a low-privileged local user account on a system running a vulnerable Linux kernel version (3.9 through pre-patch versions of 5.10, 6.1, 6.6, 6.12, 6.13–6.18, or 6.19) with NFSD loaded.
2. Open the exports proc file: Open /proc/fs/nfs/exports and keep the file descriptor open, which causes exports_proc_open() to capture the current network namespace without holding a reference.
3. Switch network namespaces: Use setns() or unshare() to move to a different network namespace, leaving the original namespace with no remaining holders other than the open file descriptor.
4. Trigger namespace destruction: Cause the original network namespace to be torn down (e.g., by destroying the container or terminating all other processes in that namespace), which triggers nfsd_net_exit() → nfsd_export_shutdown() → freeing of the svc_export_cache.
5. Trigger use-after-free: Perform a read() on the still-open file descriptor, causing the kernel to dereference the freed cache_detail structure and walk the freed hash table, resulting in memory corruption exploitable for privilege escalation (GitHub Advisory).

• Logs: Kernel oops or BUG messages in dmesg or /var/log/kern.log referencing NFSD, cache_detail, or use-after-free in the nfsd_export or svc_export_cache code paths.
• Logs: Kernel KASAN (Kernel Address Sanitizer) reports indicating use-after-free in nfsd or sunrpc subsystems.
• Process: Unusual processes calling setns() or unshare() followed by reads on /proc/fs/nfs/exports, particularly in containerized environments.
• File System: Unexpected or repeated access to /proc/fs/nfs/exports by non-administrative users or container processes, visible in audit logs (auditd) with open and read syscalls on that path.
• Network: Unexpected privilege escalation events or container escape indicators following NFSD-related kernel errors.

Upgrade to a patched kernel version: 5.10.253, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or 7.0-rc5. Patches are available via the upstream stable kernel tree and have been incorporated into distributions including SUSE, Debian, Amazon Linux 2023, and openSUSE. As a workaround, restrict access to /proc/fs/nfs/exports to trusted users only (e.g., via filesystem permissions or LSM policies), and consider disabling NFSD entirely if it is not required. Monitor for abnormal access patterns to /proc/fs/nfs/exports using auditd rules (GitHub Advisory, SUSE Advisory, Amazon Linux Advisory).

The vulnerability was announced via the Linux kernel CVE mailing list (lore.kernel.org) on April 3, 2026, and quickly indexed by multiple vulnerability tracking services. SUSE, Debian, Amazon Linux, and the Yocto Project have all issued security advisories and updated packages. Tenable released multiple Nessus detection plugins (e.g., 311335, 317729, 318240, 319659) covering affected distributions. No notable independent researcher commentary or significant social media discussion beyond routine CVE tracking has been observed (Kernel Announce, SUSE Advisory).