CVE-2026-90236

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Network File System server (NFSD) where the free ol stateid reaplist() function frees open and lock stateids by calling ->sc free() directly, bypassing the path used by nfs4 put stid(). Because open stateids in nfs4 open() and lock stateids in init lock stateid() take an sc export reference that is never dropped during teardown, the export remains pinned, which blocks the unmount process for the lifetime of the stateid. Additionally, nfs4 put stid() reads sc export before acquiring cl lock, creating a race condition with drop stid export() that could lead to the same reference being released twice.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.