CVE-2026-90039

A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A local administrator with CAP_SYS_ADMIN capabilities could trigger a null pointer dereference by attempting to unlock a filesystem or export via specific netlink commands before the NFSD internal tables are fully initialized. This could lead to a kernel crash, resulting in a denial of service.

NFSD admin state revocation paths can walk NFSv4 client state tables when the server object exists but the per net state tables are not live yet. A local actor with NFSD administration capability can trigger this through unlock_filesystem or unlock_export style control plane operations after a listener is created but before the server is fully started, causing a NULL pointer dereference and kernel crash. The same lifetime boundary also references a possible dangling pointer condition outside the NFSD_NET_UP window, so the worst case should be treated as a stale pointer or UAF candidate for manual triage. For the CVSS the PR:L is used for the paranoid score because delegated CAP_SYS_ADMIN, container root, or a service account managing NFSD may be weaker than full host administrator control in practical deployments. The issue is not directly network reachable and is triggered through local NFSD administrative interfaces rather than remote NFS client traffic. Impact is at least local denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact due to stale pointer access and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.