CVE-2026-105517

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Teddy Thobane (rootkiTed) for reporting this issue.", "bugzilla": {"description": "nfs-ganesha: nfs-ganesha: 9P TWRITE/TCLUNK race condition use-after-free", "id": "2545966", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545966"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A use-after-free vulnerability was found in the 9P protocol implementation of NFS-Ganesha. The server does not protect the lifetime of file identifier (FID) objects when processing concurrent requests. An attacker can race a write operation against a close operation on the same FID, causing one worker thread to free the FID and its associated data while another thread continues to use it. This allows attacker-controlled data to be written into freed heap memory, which can result in a crash or potentially remote code execution. The 9P protocol handler does not implement authentication, so the vulnerability is reachable without credentials by any client with network access to the 9P listener."], "mitigation": {"lang": "en:us", "value": "The 9P protocol support is not compiled in the versions of nfs-ganesha shipped in Red Hat products and Fedora. Only deployments that explicitly build nfs-ganesha with USE_9P=ON and expose a 9P listener are affected."}, "name": "CVE-2026-105517", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Not affected", "package_name": "nfs-ganesha", "product_name": "Red Hat Ceph Storage 4"}], "public_date": "2026-10-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105517\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105517"], "statement": "Red Hat's versions of nfs-ganesha do not compile the 9P protocol support, so this vulnerability does not affect any Red Hat products.", "threat_severity": "Important"}

{"created": "2026-10-06T14:45:18.428129+00:00", "updated": "2026-10-06T14:45:18.428141+00:00", "vendors": []}