CVE-2026-90038

A flaw was found in the Network File System Daemon (NFSD) component of the Linux kernel. This vulnerability, a use-after-free, occurs when the nfsd4_revoke_export_states() function improperly handles client state revocation. An administrator removing an export can trigger a race condition, potentially leading to system instability or a denial of service. This issue arises because a client lock is dropped while a state ID reference is still held, allowing the client to be freed prematurely.

Red Hat rates this vulnerability as Moderate because triggering the race condition requires specific administrative action to unexport an active file system share concurrently with client session expiration, limiting the impact to a denial of service via a kernel crash rather than arbitrary remote code execution. In typical Red Hat deployments, the kernel NFS server is not enabled by default, requiring intentional administrator configuration to expose the functionality. Furthermore, supported Red Hat Enterprise Linux releases do not include the vulnerable upstream code, preventing systems under standard support from being exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.