Use-After-Free Vulnerability in Linux Kernel Affects NFS Client Management

CVE-2026-90036

What is CVE-2026-90036?

A use-after-free vulnerability exists in the Linux kernel's NFS client management system. When a bare lock owner remains as the only reference during blocked-lock reaping, it can potentially lead to dereferencing freed memory. This occurs because the process may free the client before properly managing the lock references, which can cause security risks by allowing unauthorized access to invalid memory. The flaw has been addressed with updates that ensure proper locking mechanisms are in place to manage references correctly.

References