CVE-2026-90037

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during close_lru reaping An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid in oo_last_closed_stid, holding only a raw pointer to its nfs4_client. The laundromat reaps timed-out entries, drops nn->client_lock, and calls nfs4_put_stid(), which dereferences the client through cl_lock. Nothing pins the client across that window, so a concurrent force_expire_client() can free it and nfs4_put_stid() reads freed memory. __destroy_client() hits the same race, walking clp->cl_openowners without cl_lock. Pin the client with cl_rpc_users before dropping client_lock, and skip clients already expiring. __destroy_client() then cleans up its own close_lru entries through release_last_closed_stateid(), so teardown no longer races the laundromat.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/2330b788d732f43668b965b3105b37ceb276dfea
https://git.kernel.org/stable/c/83dd59ac1c3455c2c7d8ddb582d980a13199b9b3
https://git.kernel.org/stable/c/e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-16 11:17

Updated : 2026-09-16 11:17

NVD link : CVE-2026-90037

Mitre link : CVE-2026-90037

CVE.ORG link : CVE-2026-90037

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-90037", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "217526e7ecc9f6f243e976772e81eab7ab986a4c", "lessThan": "83dd59ac1c3455c2c7d8ddb582d980a13199b9b3", "versionType": "git"}, {"status": "affected", "version": "217526e7ecc9f6f243e976772e81eab7ab986a4c", "lessThan": "e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1", "versionType": "git"}, {"status": "affected", "version": "217526e7ecc9f6f243e976772e81eab7ab986a4c", "lessThan": "2330b788d732f43668b965b3105b37ceb276dfea", "versionType": "git"}], "programFiles": ["fs/nfsd/nfs4state.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"status": "unaffected", "version": "0", "lessThan": "3.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.51", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.5", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfsd/nfs4state.c"], "defaultStatus": "affected"}]}], "published": "2026-09-16T11:17:16.910", "references": [{"url": "https://git.kernel.org/stable/c/2330b788d732f43668b965b3105b37ceb276dfea", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/83dd59ac1c3455c2c7d8ddb582d980a13199b9b3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during close_lru reaping\n\nAn nfs4_openowner left on nn->close_lru after its final CLOSE keeps\nits last closed stateid in oo_last_closed_stid, holding only a raw\npointer to its nfs4_client. The laundromat reaps timed-out entries,\ndrops nn->client_lock, and calls nfs4_put_stid(), which dereferences\nthe client through cl_lock. Nothing pins the client across that\nwindow, so a concurrent force_expire_client() can free it and\nnfs4_put_stid() reads freed memory. __destroy_client() hits the same\nrace, walking clp->cl_openowners without cl_lock.\n\nPin the client with cl_rpc_users before dropping client_lock, and\nskip clients already expiring. __destroy_client() then cleans up its\nown close_lru entries through release_last_closed_stateid(), so\nteardown no longer races the laundromat."}], "lastModified": "2026-09-16T11:17:16.910", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}