CVE-2026-90036

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during blocked-lock reaping

A bare lock owner -- its only remaining reference a blocked lock on

nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but

no reference keeping the client alive. When the per-net laundromat

reaps such a lock, freeing the nbl drops the owner reference

held through flc_owner, and the final nfs4_put_stateowner()

takes the client's cl_lock. Because the laundromat detaches the

nbl first, __destroy_client() no longer finds it, so a concurrent

force_expire_client() can free the client before nfs4_put_stateowner()

runs, dereferencing cl_lock in freed memory.

Pin the client with cl_rpc_users before dropping

nn->blocked_locks_lock, and skip clients already expiring, whose

blocked locks __destroy_client() frees while holding an owner

reference. Take nn->client_lock outside nn->blocked_locks_lock.

Every other site holds nn->blocked_locks_lock as a leaf

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References