CVE-2026-90151

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NFSv4 implementation where the nfs4 alloc client() function allocates a callback identifier before completing client setup. If a subsequent initialization step fails, the error path calls nfs free client() directly, bypassing nfs put client(), which is responsible for removing the callback IDR entry. This results in the cb ident idr maintaining a pointer to a freed nfs client. Consequently, a subsequent callback lookup using cb ident may access this stale pointer and attempt to take a reference to it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.