CVE-2026-90036

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the NFSD component during blocked-lock reaping. A bare lock owner on nn->blocked locks lru holds a raw pointer to its nfs4 client without a reference to keep the client alive. When the per-net laundromat reaps such a lock, it detaches the nbl first. This allows a concurrent force expire client() to free the client before nfs4 put stateowner() executes, leading to the dereferencing of cl lock in freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.