CVE-2026-90036

A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This can result in memory corruption when the system attempts to access freed memory, potentially leading to a denial of service or arbitrary code execution.

A use-after-free flaw rated IMPORTANT by Red Hat was found in the Linux kernel's NFS server (NFSD) blocked-lock handling. When the per-network-namespace laundromat reaps a blocked lock whose lock owner holds only a raw pointer to its nfs4_client, without any reference keeping that client alive, a concurrent client expiry can free the client before nfs4_put_stateowner() runs, causing the client's cl_lock to be dereferenced in freed memory. This memory corruption can lead to a kernel panic (denial of service) or potentially arbitrary code execution. Exploitation requires winning a race condition between blocked-lock reaping and forced client expiry on the NFS server, which makes reliable exploitation difficult. Red Hat products that ship the affected kernel code are impacted, including Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel); a fix is being pursued by the responsible engineering teams. The kernel-ivos-qualcomm components in Red Hat In-Vehicle OS are not affected because the vulnerable code is not present. Red Hat rates this flaw lower (CVSS 7.0, IMPORTANT) than the upstream CVE.org assessment (CVSS 9.8, CRITICAL) because triggering the flaw requires a successful race on the server rather than a straightforward unauthenticated network attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, stop and disable the NFS server service if NFS exports are not required:

systemctl stop nfs-server
systemctl mask nfs-server

Alternatively, if the NFS server must remain operational, restrict network reachability to trusted clients or subnets using firewall rules:

firewall-cmd --permanent --remove-service=nfs
firewall-cmd --permanent --zone=trusted --add-source=<trusted_client_IP_or_CIDR>
firewall-cmd --permanent --zone=trusted --add-service=nfs
firewall-cmd --reload

Caveats: Disabling the service stops all file sharing functionality, and firewall rules will block any unlisted clients from mounting or accessing exports. Warning: Stopping the NFS service or reloading firewall configurations will disconnect existing client sessions and disrupt active file operations.