NFSD: Prevent client use-after-free during export state revocation
Affects the Linux kernel from 7.2.0 before 7.2.5 where the kernel NFS server (nfsd) handles export removal and client expiry. Fixed in 7.2.5.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 7.2.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's NFS server (NFSD) is affected: when an administrator removes an NFS export, a race with client expiry can cause the kernel to access freed client memory. This use-after-free could crash the system or lead to memory corruption.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4_revoke_export_states() has the same use-after-free as nfsd4_revoke_states(): it drops nn->client_lock across revoke_one_stid() and the following read of clp->cl_minorversion, but the stateid reference it holds does not pin the client. A teardown racing the dropped lock can free the client while revoke_one_stid() still dereferences it. exportfs -u drives this path through NFSD_CMD_UNLOCK_EXPORT, so an administrator removing an export can race a client expiry. Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 2eac189bb059d31a29937b29ee0f477394198610 · fixed in c05ae58fe06ce2ac34312f649e71c3596bdde358; From 2eac189bb059d31a29937b29ee0f477394198610 · fixed in 2108de53568a64936a0da3e04d85c35df98d3fb6
- Linux Linux
7.2
- KernelLinux
From 7.2.0 · fixed in 7.2.5
References 2
Questions about CVE-2026-90038
What does this mean?
The kernel NFS server can free a client structure while it is still in use, a use-after-free. It happens when an administrator removes an export at the same time a client expiry runs, because the teardown can free the client while the revocation code still dereferences it.Source: git.kernel.org
Am I affected, and how do I check?
The affected range is listed as Linux kernel 7.2.0 up to, but not including, 7.2.5, with the NFS server (nfsd) in use. To check, run uname -r for the kernel version and look at whether the NFS server is serving exports, for example with exportfs -v.Source: git.kernel.org
What should I do about it?
Update the kernel to 7.2.5 or later, which is the fixed release listed for this issue.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data