CVE-2026-90037 Overview
CVE-2026-90037 is a use-after-free vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw resides in the close_lru reaping path, where an nfs4_openowner retains its last closed stateid through oo_last_closed_stid, holding only a raw pointer to its nfs4_client. When the laundromat reaps timed-out entries and calls nfs4_put_stid(), a concurrent force_expire_client() can free the client structure, causing the kernel to dereference freed memory. The same race affects __destroy_client() when walking clp->cl_openowners without cl_lock.
Critical Impact
Remote attackers with NFS access can trigger a kernel use-after-free condition, leading to memory corruption, denial of service, or potential privilege escalation on affected NFS servers.
Affected Products
- Linux kernel with NFSD subsystem enabled
- Systems exporting file systems via NFSv4
- Multi-tenant NFS servers subject to client expiration events
Discovery Timeline
- 2026-09-16 - CVE-2026-90037 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90037
Vulnerability Analysis
The vulnerability is a use-after-free condition [CWE-416] in the NFSD stateid lifecycle management. An nfs4_openowner structure remains on the per-network-namespace nn->close_lru list after its final CLOSE operation. This structure retains a reference to the last closed stateid via oo_last_closed_stid, which in turn holds only a raw, unreferenced pointer to the owning nfs4_client.
The NFSD laundromat kthread periodically scans close_lru for entries that have exceeded their retention window. During reaping, the laundromat drops nn->client_lock before calling nfs4_put_stid(). This function dereferences the client pointer through cl_lock to complete stateid cleanup. Because nothing pins the client across this critical window, the sequence is unsafe against concurrent teardown.
Root Cause
The root cause is missing reference counting on the nfs4_client structure during asynchronous stateid cleanup. The laundromat assumed the raw client pointer stored in the stateid remained valid after releasing client_lock, but force_expire_client() can run concurrently and free the client. A parallel path in __destroy_client() walks clp->cl_openowners without holding cl_lock, exhibiting the same race window.
Attack Vector
An attacker with network access to an NFS export can influence client expiration timing through connection manipulation, stale client handling, or forced client eviction. Concurrent client expiration and laundromat execution triggers the race. Successful exploitation reads or writes freed kernel memory, which can produce a kernel panic or, with careful heap grooming, memory corruption suitable for privilege escalation.
The upstream fix pins the client with cl_rpc_users before dropping client_lock and skips clients already marked as expiring. __destroy_client() now cleans up its own close_lru entries through release_last_closed_stateid(), eliminating the teardown race with the laundromat. See the kernel commits 2330b78, 83dd59a, and e57a9ed for technical details.
Detection Methods for CVE-2026-90037
Indicators of Compromise
- Kernel oops or panic messages referencing nfs4_put_stid, nfsd4_laundromat, or __destroy_client in dmesg and /var/log/messages.
- KASAN reports flagging use-after-free access in the NFSD subsystem when kernel address sanitization is enabled.
- Unexpected NFSD service restarts or thread crashes coinciding with high client churn or forced client expirations.
Detection Strategies
- Monitor kernel ring buffers for stack traces containing nfs4_openowner, oo_last_closed_stid, or force_expire_client symbols.
- Correlate NFSv4 client expiration events with kernel fault telemetry to identify race-triggered crashes.
- Deploy KASAN or KFENCE on test kernels to surface latent use-after-free conditions before production impact.
Monitoring Recommendations
- Track running kernel versions across the fleet and flag hosts running vulnerable NFSD builds.
- Alert on NFS server availability drops and repeated kernel soft lockups on file server hosts.
- Ingest kernel logs into a centralized analytics platform for pattern-based detection of NFSD faults.
How to Mitigate CVE-2026-90037
Immediate Actions Required
- Inventory all Linux hosts running the NFSD kernel module and identify those exporting NFSv4 shares.
- Apply the stable kernel updates containing the fix commits as soon as vendor packages become available.
- Restrict NFS exports to trusted network segments using firewall rules and export access control lists.
Patch Information
The fix is available in upstream stable branches through commits 2330b788d732f43668b965b3105b37ceb276dfea, 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3, and e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1. The patch pins the nfs4_client via cl_rpc_users before dropping client_lock, skips clients already expiring, and moves close_lru cleanup for destroyed clients into release_last_closed_stateid(). Distribution vendors will backport these commits into supported kernel packages.
Workarounds
- Where feasible, disable NFSv4 stateful features or unexport shares on hosts that cannot be patched immediately.
- Limit exposure by binding NFSD to internal interfaces and blocking TCP/UDP ports 2049 at the perimeter.
- Reduce client churn by tuning nfsd lease and grace periods to lower the frequency of close_lru reaping under load.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.