Use-After-Free Vulnerability in Linux Kernel Affecting NFS Client Operations

CVE-2026-90037

What is CVE-2026-90037?

A use-after-free vulnerability affecting the Linux Kernel has been identified, where an nfs4_openowner may remain on nn->close_lru after its final CLOSE. This occurs because the last closed stateid in oo_last_closed_stid holds only a raw pointer to its nfs4_client. The issue surfaces when the laundromat reaps timed-out entries and drops nn->client_lock, calling nfs4_put_stid() to dereference the client through cl_lock. Without appropriate pinning of the client, it risks being freed by concurrent operations. The fix involves correctly pinning the client with cl_rpc_users before dropping the client lock, ensuring that cleanup processes do not interfere with active client use.

References