CVE-2026-74730: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-74730 is a use-after-free vulnerability in the Linux kernel's NFS (Network File System) implementation, specifically in the handling of FREE_STATEID operations. When a FREE_STATEID RPC call is delayed, the struct nfs_server object can be deallocated while the operation is still in flight, resulting in a dangling pointer dereference. The vulnerability affects Linux kernel versions from 3.10 up to the fixed releases across multiple stable branches. It was published on August 22, 2026, with patches available the same day. The CVSS base score is listed as 0.0 (pending full scoring), with Feedly estimating a Medium severity (GitHub Advisory, Feedly).

The root cause is a missing reference count increment on the struct nfs_server object before initiating a FREE_STATEID RPC operation (CWE-416: Use After Free). When the operation is delayed — for example, due to network latency or scheduling — the NFS server structure's refcount can reach zero and the object freed, while the in-flight operation still holds a pointer to it. The fix bumps the refcount of struct nfs_server for the duration of the FREE_STATEID call, ensuring the object remains valid until the operation completes. The vulnerability was originally reported by Dan Aloni (GitHub Advisory).

Successful exploitation can allow an attacker with the ability to trigger NFS FREE_STATEID operations — typically a local user or an authenticated NFS client — to cause kernel memory corruption via the use-after-free condition. This may lead to arbitrary code execution with kernel privileges or a system crash (denial of service), compromising the full confidentiality, integrity, and availability of the affected host. Given kernel-level access, lateral movement within a network environment is also a realistic post-exploitation scenario (Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly, GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to trigger delayed NFS FREE_STATEID operations, which limits the attack surface to local users or authenticated NFS clients.

Patches have been backported to all active stable Linux kernel branches. The fixed versions are: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2 (mainline). Administrators should update to the patched kernel version corresponding to their branch as soon as possible. As a temporary workaround where patching is not immediately feasible, restricting NFS access to trusted clients only can reduce exposure (GitHub Advisory, Feedly).