CVE-2026-90037

A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A race condition exists during the cleanup of NFSv4 client connections, specifically when the system attempts to reclaim resources from timed-out clients. This can lead to a use-after-free vulnerability, where the system tries to access memory that has already been released. A remote attacker could potentially exploit this to cause a system crash, resulting in a Denial of Service (DoS).

A use-after-free can occur in the NFSD NFSv4 state handling path when an nfs4_openowner remains on close_lru after the final CLOSE and keeps oo_last_closed_stid with only a raw pointer to its nfs4_client. During close_lru reaping, nfs4_laundromat can drop client_lock and call nfs4_put_stid(), while a concurrent client expiration path can free the same nfs4_client and make later cl_lock access read freed memory. For the CVSS the PR:L is used because a remote NFSv4 client normally needs access to the exported NFS service or valid client state, but full local administrative privileges on the server are not required. The issue is network reachable when NFSD NFSv4 is exposed to the attacker, although NFS servers are commonly limited to trusted internal or storage networks. Impact is at least denial of service via kernel crash. In the paranoid interpretation, this is a kernel use-after-free race and may allow broader confidentiality or integrity impact, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.