{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90037","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.782Z","datePublished":"2026-09-16T10:33:36.673Z","dateUpdated":"2026-09-21T13:15:13.135Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-21T13:15:13.135Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during close_lru reaping\n\nAn nfs4_openowner left on nn->close_lru after its final CLOSE keeps\nits last closed stateid in oo_last_closed_stid, holding only a raw\npointer to its nfs4_client. The laundromat reaps timed-out entries,\ndrops nn->client_lock, and calls nfs4_put_stid(), which dereferences\nthe client through cl_lock. Nothing pins the client across that\nwindow, so a concurrent force_expire_client() can free it and\nnfs4_put_stid() reads freed memory. __destroy_client() hits the same\nrace, walking clp->cl_openowners without cl_lock.\n\nPin the client with cl_rpc_users before dropping client_lock, and\nskip clients already expiring. __destroy_client() then cleans up its\nown close_lru entries through release_last_closed_stateid(), so\nteardown no longer races the laundromat."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - nfsd is the in-kernel NFS server. A remote NFSv4.0 client reaches the UAF over TCP/UDP 2049: CLOSE places the openowner on nn->close_lru, and SETCLIENTID_CONFIRM (ALLOWED_WITHOUT_FH) calls expire_client() while nfs4_laundromat() drops client_lock and nfs4_put_stid() uses the unpinned nfs4_client.\nAC:L - The attacker drives both sides: OPEN/CLOSE compounds fill close_lru so the laundromat drops client_lock once per nfs4_put_stid(), and concurrent SETCLIENTID_CONFIRM with matching AUTH_SYS creds replaces the client via expire_client(). FATTR4_LEASE_TIME times the window; flooding close_lru widens it; the race is retryable.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL, so RPC uids are self-asserted. SETCLIENTID and SETCLIENTID_CONFIRM are ALLOWED_WITHOUT_FH; any host allowed by the export can OPEN/CLOSE and replace the client with no local account or capability on the NFS server.\nUI:N - The attacker issues the NFSv4.0 compounds (SETCLIENTID, OPEN, CLOSE, RENEW, SETCLIENTID_CONFIRM) itself. No administrator or other user on the victim server must mount a filesystem, write nfsdfs ctl, or otherwise interact.\nS:U - The use-after-free is of the nfsd nfs4_client object (client_slab) in the NFS server kernel. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After free_client() kmem_cache_free()s the nfs4_client, nfs4_put_stid() still reads cl_lock and cl_stateids. Reclaiming the mergeable client_slab object via further SETCLIENTID discloses kernel heap; a UAF is C:H.\nI:H - nfs4_put_stid() then takes cl_lock and idr_remove()s from cl_stateids on the freed nfs4_client, a slab UAF write concurrent with __destroy_client(). Heap reuse enables arbitrary write and control-flow hijack; a UAF is I:H.\nA:H - Use-after-free of nfs4_client in nfs4_put_stid() (spin_lock of freed cl_lock) oopses or panics the nfsd laundromat worker even without a full exploit, denying service of the NFS server host."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs4state.c"],"versions":[{"version":"217526e7ecc9f6f243e976772e81eab7ab986a4c","lessThan":"0763482227822f7343557f086afc382086d56c4c","status":"affected","versionType":"git"},{"version":"217526e7ecc9f6f243e976772e81eab7ab986a4c","lessThan":"83dd59ac1c3455c2c7d8ddb582d980a13199b9b3","status":"affected","versionType":"git"},{"version":"217526e7ecc9f6f243e976772e81eab7ab986a4c","lessThan":"e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1","status":"affected","versionType":"git"},{"version":"217526e7ecc9f6f243e976772e81eab7ab986a4c","lessThan":"2330b788d732f43668b965b3105b37ceb276dfea","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs4state.c"],"versions":[{"version":"3.17","status":"affected"},{"version":"0","lessThan":"3.17","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0763482227822f7343557f086afc382086d56c4c"},{"url":"https://git.kernel.org/stable/c/83dd59ac1c3455c2c7d8ddb582d980a13199b9b3"},{"url":"https://git.kernel.org/stable/c/e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1"},{"url":"https://git.kernel.org/stable/c/2330b788d732f43668b965b3105b37ceb276dfea"}],"title":"NFSD: Prevent client use-after-free during close_lru reaping","x_generator":{"engine":"bippy-1.2.0"}}}}