CVE-2026-90037

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during close_lru reaping

An nfs4_openowner left on nn->close_lru after its final CLOSE keeps

its last closed stateid in oo_last_closed_stid, holding only a raw

pointer to its nfs4_client. The laundromat reaps timed-out entries,

drops nn->client_lock, and calls nfs4_put_stid(), which dereferences

the client through cl_lock. Nothing pins the client across that

window, so a concurrent force_expire_client() can free it and

nfs4_put_stid() reads freed memory. __destroy_client() hits the same

race, walking clp->cl_openowners without cl_lock.

Pin the client with cl_rpc_users before dropping client_lock, and

skip clients already expiring. __destroy_client() then cleans up its

own close_lru entries through release_last_closed_stateid(), so

teardown no longer races the laundromat.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References