CVE-2026-90038

CVE-2026-90038 is a use-after-free in the Linux kernel's NFS server (NFSD): nfsd4_revoke_export_states() drops the shared client_lock across revoke_one_stid() and a subsequent read of clp->cl_minorversion, and the stateid reference it holds does not pin the client, so a concurrent client teardown can free the client while it is still being dereferenced. The flaw is reached when an administrator removes an NFS export — exportfs -u drives the path via the NFSD_CMD_UNLOCK_EXPORT netlink command — and that revocation races with a client expiry. Successful triggering yields a kernel use-after-free that can crash the server (denial of service) and, as is typical for kernel UAF bugs, may be exploitable for privilege escalation; the assigned CVSS 3.1 score is 9.8 critical (AV:N/AC:L/PR:N), although practical triggering requires the export-revocation path to race client expiry. Any Linux system acting as an NFS server with the export-state revocation code is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Apply the upstream patch 'NFSD: Prevent client use-after-free during export state revocation' and update to a kernel that includes the fix. As an interim mitigation, avoid removing exports (exportfs -u / NFSD_CMD_UNLOCK_EXPORT) while NFSv4 clients are active or expiring, and schedule export changes during maintenance windows. Check whether your running kernel contains the nfsd4_revoke_export_states()/UNLOCK_EXPORT code to determine if the issue is relevant to your systems.