CVE-2026-90148

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NFSv4 implementation where nfs4 add lease() may pass an incorrect argument to nfs4 delete lease() during a race condition with a delegation return. Specifically, the priv variable, which can be NULL, is passed to nfs4 delete lease(), subsequently causing a NULL pointer dereference in the generic setlease() function. A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically resulting in a system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.