CVE-2026-90038: Linux Kernel Use-After-Free Vulnerability

CVE-2026-90038 Overview

CVE-2026-90038 is a use-after-free vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw exists in the nfsd4_revoke_export_states() function, which handles revocation of NFSv4 state during export teardown. The function drops the nn->client_lock across a call to revoke_one_stid() and a subsequent read of clp->cl_minorversion, but the stateid reference it holds does not pin the client structure. A concurrent client teardown can free the client while revoke_one_stid() still dereferences it, producing a use-after-free condition on kernel memory.

Critical Impact
A race between exportfs -u and NFSv4 client expiry can trigger kernel memory corruption, enabling denial of service and potentially remote code execution against NFS servers.

Affected Products

Linux kernel NFSD subsystem (NFSv4 server)
Linux distributions shipping affected upstream kernel versions
Systems exporting filesystems over NFSv4 to remote clients

Discovery Timeline

2026-09-16 - CVE-2026-90038 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90038

Vulnerability Analysis

The vulnerability resides in nfsd4_revoke_export_states(), a function invoked when an administrator removes an NFS export through the NFSD_CMD_UNLOCK_EXPORT path, typically via exportfs -u. The function iterates through NFSv4 state identifiers (stateids) associated with the export and calls revoke_one_stid() to invalidate each one.

During this iteration, the code drops nn->client_lock to perform revocation work. The stateid holds a reference that keeps the stateid object alive, but that reference does not pin the parent client structure (clp). If a client expiry runs concurrently while client_lock is released, the teardown path can free the client while revoke_one_stid() and the subsequent read of clp->cl_minorversion still access it.

The upstream fix mirrors the correction applied to the sibling function nfsd4_revoke_states(). The patched code skips clients already marked for expiry and otherwise pins the client with cl_rpc_users under client_lock before releasing the lock. This ensures the client structure remains valid across the critical section.

Root Cause

The root cause is a lifetime-management error in kernel synchronization. The developer assumed a stateid reference implicitly pinned its owning client, but the two objects have independent reference counts. Releasing client_lock without acquiring cl_rpc_users on the client creates a window for concurrent free.

Attack Vector

Triggering the race requires an administrator action (exportfs -u) occurring concurrently with an NFSv4 client expiring or being torn down. An attacker with the ability to influence client session lifetime on a target NFS server, combined with a predictable or attacker-influenced export-removal operation, could increase the likelihood of hitting the race. The CVSS vector indicates a network-reachable attack path with no privileges or user interaction required. See the kernel commit details and commit changes for the fix.

Detection Methods for CVE-2026-90038

Indicators of Compromise

Kernel oops or panic messages referencing nfsd4_revoke_export_states, revoke_one_stid, or cl_minorversion in dmesg and /var/log/messages.
KASAN reports indicating use-after-free within the NFSD stateid revocation path.
Unexpected NFS server crashes or reboots correlated with exportfs -u operations.

Detection Strategies

Monitor kernel logs for NFSD-related stack traces and slab corruption warnings on servers exporting NFSv4 mounts.
Correlate administrator invocations of exportfs -u with NFSv4 client expiry events to identify race exposure.
Enable KASAN or KFENCE in test environments to surface use-after-free access on stateid revocation paths.

Monitoring Recommendations

Track NFS server availability metrics and alert on unplanned restarts of the nfs-server service.
Collect kernel crash dumps with kdump to preserve evidence for post-crash analysis.
Audit privileged administrative activity involving exportfs and NFSD configuration changes.

How to Mitigate CVE-2026-90038

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the two git.kernel.org stable commits and reboot affected NFS servers.
Update to a distribution kernel that incorporates the fix once vendors publish backports.
Restrict administrative access to exportfs and NFS management interfaces to trusted operators.

Patch Information

The fix is applied in the mainline Linux kernel. It skips clients already expiring and pins the client with cl_rpc_users under client_lock before dropping the lock, matching the pattern used in nfsd4_revoke_states(). Review the upstream commit and the related change for the exact code diff.

Workarounds

Avoid running exportfs -u while active NFSv4 clients may be expiring; schedule export removals during maintenance windows with clients disconnected.
Where feasible, restrict NFSD to NFSv3 on unpatched hosts until the kernel update is deployed, since the vulnerability is specific to NFSv4 state revocation.
Limit network exposure of the NFS server to trusted client subnets using firewall rules.

bash

# Example: restrict NFS server exposure with firewalld until patched
firewall-cmd --permanent --zone=internal --add-service=nfs
firewall-cmd --permanent --zone=public --remove-service=nfs
firewall-cmd --reload

# Verify running kernel version after applying the patch
uname -r