CVE-2026-90036: Linux Kernel Use-After-Free Vulnerability

CVE-2026-90036 Overview

CVE-2026-90036 is a use-after-free vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw resides in the blocked-lock reaping path, where the per-net laundromat can drop the final reference to an nfs4_stateowner while a concurrent force_expire_client() frees the associated nfs4_client. The subsequent call to nfs4_put_stateowner() dereferences cl_lock in freed memory. Attackers with network access to an exposed NFSv4 server can trigger the race to corrupt kernel memory, cause denial of service, or potentially escalate privileges.

Critical Impact
Remote, unauthenticated exploitation of the race can lead to kernel memory corruption and system compromise on affected NFSv4 servers.

Affected Products

Linux kernel NFSD (in-kernel NFS server) — versions prior to the fixes committed upstream
Distributions shipping vulnerable stable kernel branches referenced in the upstream commits
Systems exposing NFSv4 mounts with byte-range locking to untrusted clients

Discovery Timeline

2026-09-16 - CVE-2026-90036 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90036

Vulnerability Analysis

The vulnerability is a classic use-after-free race condition in NFSD's stateful lock management. A "bare" lock owner — one whose only remaining reference is a blocked lock queued on nn->blocked_locks_lru — holds a raw pointer to its nfs4_client without taking a reference that keeps the client alive.

When the per-net laundromat reaps such a lock, freeing the nfs4_blocked_lock (nbl) drops the owner reference held through flc_owner. The final nfs4_put_stateowner() then attempts to take the client's cl_lock. Because the laundromat detaches the nbl first, __destroy_client() no longer finds it on the list.

A concurrent force_expire_client() can therefore free the nfs4_client before nfs4_put_stateowner() runs. The result is a dereference of cl_lock inside already-freed memory, giving an attacker a window to corrupt kernel state.

Root Cause

The root cause is missing reference counting between the blocked-lock reaping path and client teardown. The bare lock owner relied on the blocked lock's presence on nn->blocked_locks_lru to imply client liveness, but detachment during reaping breaks that invariant before the final stateowner release.

Attack Vector

An unauthenticated network attacker who can reach an NFSv4 server and perform lock operations can attempt to race client expiration against blocked-lock reaping. Repeated blocking-lock requests followed by client expiration events increase the probability of hitting the window. Successful exploitation yields kernel memory corruption.

No public proof-of-concept is available. The upstream fix pins the client with cl_rpc_users before dropping nn->blocked_locks_lock, skips clients already expiring, and reorders locks so nn->client_lock is acquired outside nn->blocked_locks_lock.

Detection Methods for CVE-2026-90036

Indicators of Compromise

Kernel oops or KASAN: use-after-free reports referencing nfs4_put_stateowner, cl_lock, or nfsd4_laundromat
Unexpected nfsd thread crashes correlated with NFSv4 client churn or forced client expiration
Repeated NFSv4 LOCK operations from a single client resulting in blocked-lock queue growth followed by client termination

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free during NFSD stress workloads that combine blocking locks with client expiry
Monitor dmesg and /var/log/messages for stack traces containing nfs4_put_stateowner, free_blocked_lock, and force_expire_client
Correlate NFSD RPC audit records with kernel panic events to identify anomalous client behavior preceding a crash

Monitoring Recommendations

Ingest kernel crash logs and NFSD telemetry into a centralized SIEM for pattern analysis across hosts
Track NFSv4 lock operation rates and blocked-lock queue depth as leading indicators of exploitation attempts
Alert on unexpected nfsd service restarts or kernel panics on file servers exposing NFSv4

How to Mitigate CVE-2026-90036

Immediate Actions Required

Apply the upstream kernel fixes referenced in the Kernel Git commit cd489b0, commit 6fedb2e, and commit 9026932
Rebuild and deploy distribution kernels once vendor packages incorporating these commits are available
Restrict NFSv4 server exposure to trusted network segments until patched kernels are running

Patch Information

The fix pins the nfs4_client with cl_rpc_users before releasing nn->blocked_locks_lock, skips clients already in the expiring state so __destroy_client() can free their blocked locks while holding an owner reference, and reorders lock acquisition so nn->client_lock is taken outside nn->blocked_locks_lock. Track your distribution's stable kernel updates for backports referencing the commit hashes above.

Workarounds

Limit NFSv4 access with host-based firewalling (iptables/nftables) to authenticated, trusted client subnets
Disable NFSv4 byte-range locking exposure to untrusted clients where operationally feasible
Reduce client expiration churn by tuning NFSv4 lease and grace parameters to shrink the race window

bash

# Configuration example: restrict NFSv4 to trusted subnet and verify kernel version
sudo nft add rule inet filter input tcp dport 2049 ip saddr != 10.0.0.0/24 drop
uname -r