CVE-2026-22980

CVE-2026-22980 is a use-after-free vulnerability in the Linux kernel's NFS daemon (nfsd) that occurs due to a race condition during server shutdown when writing to v4_end_grace. This flaw can lead to memory being accessed after it has been freed, specifically within the reclaim_str_hashtbl function. Rated with a CVSS score of 7.8 (High), this vulnerability has a local attack vector, low attack complexity, and can result in high impacts to confidentiality, integrity, and availability. The underlying cause is identified as CWE-416 (Use-After-Free). Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Despite this, the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness and interest within the cybersecurity community.