CVE-2026-123042

A double-free and use-after-free vulnerability was found in NFS-Ganesha. When an NFSv4.1 COMPOUND request caches a READ reply in the session-slot replay cache, the READ data buffer is freed on first transmission but the cache retains a dangling pointer. A subsequent legal protocol replay re-sends the freed buffer contents to the client and frees the pointer again, resulting in remote heap information disclosure and a daemon crash.