Executive brief
The Linux kernel's NFS server (NFSD) contains a memory safety vulnerability in its blocked-lock cleanup routine. An attacker with network access to an NFS server can trigger a use-after-free condition that crashes the kernel or potentially executes arbitrary code, disrupting file service availability and putting stored data at risk.
Technical details
The vulnerability is a use-after-free in the nfs4_laundromat() function within the NFSD subsystem. The root cause is a race condition where a lock owner holds a raw pointer to an nfs4_client without incrementing the client's reference count. When the laundromat reaps expired blocked locks, it may free the client before nfs4_put_stateowner() executes, causing the latter to dereference already-freed client memory (cl_lock). The attack vector is network-based; any NFS client can trigger the condition by creating blocked locks and timing the reaping. The fix pins the client with cl_rpc_users before releasing the blocked_locks_lock and adds additional client expiry checks to prevent accessing already-freed clients. A patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel affected versions include kernels containing the blocked-lock LRU feature (introduced in commit 7919d0a27f1e)
Timeline
- 2026-09-16: disclosed: CVE-2026-90036 published
- 2026-09-07: patched: Fix committed by Chuck Lever
- 2026-09-11: patched: Patch merged into Linux stable tree