CVE-2026-90151

A flaw was found in the Linux kernel's Network File System version 4 (NFSv4) component. This vulnerability occurs when an NFSv4 client allocation fails, leaving a stale pointer to a freed client. A local attacker could potentially exploit this use-after-free condition by triggering a callback lookup, which may lead to memory corruption, causing system instability or a denial of service.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access, specific preconditions, and precise timing during a failed NFSv4 client initialization to reference the dangling pointer. While an unremoved callback entry could result in memory corruption or system instability, the issue cannot be triggered remotely over the network without an active mount failure scenario on the client. Environments that do not mount remote NFSv4 file systems are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.