CVE-2026-90037

A use-after-free flaw in the Linux kernel's NFS server daemon (NFSD) occurs when an open owner left on the close_lru list after its final CLOSE keeps its last closed stateid holding only a raw, unpinned pointer to its nfs4_client. When the NFSD laundromat thread reaps a timed-out entry it drops the client lock and calls nfs4_put_stid(), which dereferences the client through cl_lock; a concurrent force_expire_client() can free the client in that window, so the server reads freed kernel memory, and __destroy_client() hits the same race by walking cl_openowners without holding cl_lock. An attacker acting as an NFS client that opens/closes files and triggers or coincides with client expiry could corrupt server kernel memory, most plausibly crashing the server (denial of service) and potentially more, per the critical CVSS score. Any Linux system running the in-kernel NFSv4 server (NFSD) — enterprise file servers, virtualization storage hosts, and Linux-based NAS appliances — is potentially affected. No public proof-of-concept or in-the-wild exploitation is currently known.

What to do: Upgrade to a kernel that includes the NFSD fix (pinning the client via cl_rpc_users before dropping client_lock) — since no fixed version is given in the advisory, follow your distribution's kernel security tracker for the backported update. Until patched, restrict NFS access (TCP/UDP 2049 and related ports) to trusted client networks with firewall rules and tight export ACLs, and avoid unnecessary forced client-expiry operations on production servers. Monitor servers for NFSD crashes, hung NFS clients, or kernel use-after-free/oops messages involving nfs4_put_stid or the laundromat thread.