CVE-2026-90036

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops the owner reference held through flc_owner, and the final nfs4_put_stateowner() takes the client's cl_lock. Because the laundromat detaches the nbl first, __destroy_client() no longer finds it, so a concurrent force_expire_client() can free the client before nfs4_put_stateowner() runs, dereferencing cl_lock in freed memory. Pin the client with cl_rpc_users before dropping nn->blocked_locks_lock, and skip clients already expiring, whose blocked locks __destroy_client() frees while holding an owner reference. Take nn->client_lock outside nn->blocked_locks_lock. Every other site holds nn->blocked_locks_lock as a leaf, acquiring no further lock, so placing nn->client_lock outside it cannot form a lock-order cycle.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0
https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671
https://git.kernel.org/stable/c/cd489b03587378645fe0d20142a33f1ed60bac98

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-16 11:17

Updated : 2026-09-16 11:17

NVD link : CVE-2026-90036

Mitre link : CVE-2026-90036

CVE.ORG link : CVE-2026-90036

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-90036", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b", "lessThan": "cd489b03587378645fe0d20142a33f1ed60bac98", "versionType": "git"}, {"status": "affected", "version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b", "lessThan": "6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0", "versionType": "git"}, {"status": "affected", "version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b", "lessThan": "9026932ac8be4d0ae01db47f23619a98cc57b671", "versionType": "git"}], "programFiles": ["fs/nfsd/nfs4state.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.51", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.5", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfsd/nfs4state.c"], "defaultStatus": "affected"}]}], "published": "2026-09-16T11:17:16.803", "references": [{"url": "https://git.kernel.org/stable/c/6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cd489b03587378645fe0d20142a33f1ed60bac98", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during blocked-lock reaping\n\nA bare lock owner -- its only remaining reference a blocked lock on\nnn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but\nno reference keeping the client alive. When the per-net laundromat\nreaps such a lock, freeing the nbl drops the owner reference\nheld through flc_owner, and the final nfs4_put_stateowner()\ntakes the client's cl_lock. Because the laundromat detaches the\nnbl first, __destroy_client() no longer finds it, so a concurrent\nforce_expire_client() can free the client before nfs4_put_stateowner()\nruns, dereferencing cl_lock in freed memory.\n\nPin the client with cl_rpc_users before dropping\nnn->blocked_locks_lock, and skip clients already expiring, whose\nblocked locks __destroy_client() frees while holding an owner\nreference. Take nn->client_lock outside nn->blocked_locks_lock.\nEvery other site holds nn->blocked_locks_lock as a leaf, acquiring\nno further lock, so placing nn->client_lock outside it cannot form\na lock-order cycle."}], "lastModified": "2026-09-16T11:17:16.803", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}