Local Kernel Vulnerability in Linux Kernel Impacting NFSD Services

CVE-2026-90039

What is CVE-2026-90039?

A vulnerability in the Linux kernel's Network File System (NFS) services, particularly within the NFSD components, can lead to a local denial of service. When an administrator attempts to revoke open states or cancel asynchronous operations by using specific commands or modifying the NFS filesystem, it can inadvertently trigger a NULL pointer dereference. This occurs due to the improper sequence of initialization and service creation in the NFSD setup. If exploited, this vulnerability can cause kernel crashes, potentially allowing a local administrator with elevated permissions to disrupt server operations without needing to start the server itself. The issue has been addressed by ensuring that necessary safeguards are in place during the service's startup sequence, preventing unauthorized access and system instability.

References