CVE-2026-90039

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the NFSD component. A local administrator with CAP SYS ADMIN privileges can crash the kernel by triggering a state-revocation walk before the server has fully started. This occurs when writing to the /proc/fs/nfsd/unlock filesystem endpoint or sending the NFSD CMD UNLOCK FILESYSTEM or NFSD CMD UNLOCK EXPORT netlink commands. The issue arises because the nn->nfsd serv variable is set before the nn->conf id hashtbl is allocated in nfsd startup net(), allowing the walkers to dereference a NULL table.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.