CVE-2026-31404: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31404 is a use-after-free / NULL pointer dereference vulnerability in the Linux kernel's NFSD (Network File System Daemon) subsystem, specifically in the export put callbacks (svc_export_put() and expkey_put()). The flaw arises because sub-object cleanup (via path_put() and auth_domain_put()) occurs before the RCU grace period completes, allowing concurrent RCU readers to access already-freed memory. Affected kernel versions include 6.14 through 6.18.19, 6.19 through 6.19.9, and 7.0-rc1 through 7.0-rc4. It was published on April 3, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is classified as CWE-476 (NULL Pointer Dereference), stemming from a race condition between RCU readers and cache cleanup in the NFSD export subsystem. svc_export_put() calls path_put() and auth_domain_put() immediately upon the last reference drop — before the RCU grace period — while RCU readers in e_show() and c_show() concurrently access ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. When cache_clean removes an entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path. The same pattern exists in expkey_put() affecting ek_path and ek_client. A prior partial fix (commit 2530766492ec) moved kfree of ex_uuid and ex_stats into a call_rcu callback but left path_put() and auth_domain_put() unprotected because they may sleep and call_rcu callbacks execute in softirq context (GitHub Advisory).

Successful exploitation can cause kernel panics or denial of service on Linux systems running NFSD, disrupting NFS services for all connected clients. The vulnerability has high confidentiality, integrity, and availability impact scores, meaning a local attacker with low privileges could potentially leverage the crash to escalate privileges or corrupt kernel memory. Systems acting as NFS servers are most at risk, and exploitation during concurrent export cache cleanup operations could render NFS services completely unavailable (GitHub Advisory).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing NULL pointer dereference oops messages referencing d_path, e_show, c_show, svc_export_put, or expkey_put in the NFSD subsystem.
• System Behavior: Unexpected kernel panics or system reboots on hosts serving NFS exports, particularly during periods of high NFS export cache churn.
• Process: NFS daemon (nfsd) crashes or restarts correlated with concurrent access to /proc/net/rpc/nfsd.export or similar RCU-protected export cache entries.

Apply kernel patches that replace call_rcu/kfree_rcu with queue_rcu_work() in both svc_export_put() and expkey_put(), deferring cleanup to process context after the RCU grace period. Fixed versions include Linux kernel 6.18.20+ and 6.19.10+; patches are available at the stable kernel tree (GitHub Advisory). Vendor-specific updates are available from SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1) and Amazon Linux 2023 (ALAS2023-2026-1596). If immediate patching is not possible, limit NFS service exposure by restricting access to trusted networks and monitor kernel logs for NULL pointer dereference messages in the NFSD subsystem.

The vulnerability was announced via the Linux kernel CVE mailing list (lore.kernel.org) and picked up by standard vulnerability tracking services including Tenable Nessus (plugin 311340), Qualys, INCIBE-CERT, and the Yocto Project security list. No notable independent researcher commentary or significant social media discussion beyond automated CVE tracking has been observed.