CVE-2026-90037

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the NFSD component. An nfs4 openowner remaining on nn->close lru after a final CLOSE operation retains a raw pointer to its nfs4 client. When the laundromat reaps timed-out entries, it drops nn->client lock and calls nfs4 put stid(), which dereferences the client via cl lock. Because the client is not pinned during this window, a concurrent force expire client() call can free the client, leading nfs4 put stid() to read freed memory. Additionally, destroy client() encounters the same race condition when traversing clp->cl openowners without cl lock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.