Use-after-free in Linux kernel NFSD /proc/fs/nfs/exports handling

CVE-2026-31403 is a use-after-free vulnerability in the Linux kernel NFSD subsystem involving the /proc/fs/nfs/exports proc entry. The proc entry is created at module initialization and persists for the lifetime of the module. In the vulnerable code path, exports_proc_open() captures the caller's current network namespace and stores that namespace's svc_export_cache in seq->private, but does not take a reference on the associated struct net. If that network namespace is later torn down, nfsd_net_exit() invokes nfsd_export_shutdown(), which frees the export cache. A process that still holds an open file descriptor for /proc/fs/nfs/exports can then perform subsequent reads that dereference the freed cache_detail structure and walk a freed hash table. The fix is to hold a reference to the network namespace for the lifetime of the open exports file descriptor and release it in exports_release(), using the cache_detail net pointer already stored in cd->net.