CVE-2026-74730 (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.

Is your site exposed to CVE-2026-74730?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0051

Probability of exploitation

0.42%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2 https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890 https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894 https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8

Frequently Asked Questions

What is CVE-2026-74730? +

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-74730? +

CVE-2026-74730 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0051, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-74730? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-74730