CVE-2026-90039 Overview
CVE-2026-90039 is a NULL pointer dereference vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw exists in the admin state-revocation code paths that walk the NFSv4 client hash tables. A local administrator with CAP_SYS_ADMIN can crash the kernel by triggering these paths before the NFSD server threads are started, when the required hash tables have not yet been allocated.
Critical Impact
A local privileged user can trigger a kernel NULL pointer dereference and crash the system without ever starting the NFS service, resulting in denial of service.
Affected Products
- Linux kernel versions containing the vulnerable NFSD admin state-revocation code paths
- Systems exposing /proc/fs/nfsd/unlock_filesystem
- Systems accepting the NFSD_CMD_UNLOCK_FILESYSTEM and NFSD_CMD_UNLOCK_EXPORT netlink commands
Discovery Timeline
- 2026-09-16 - CVE-2026-90039 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90039
Vulnerability Analysis
The vulnerability resides in three NFSD administrative interfaces that revoke open state and cancel asynchronous COPY operations. Writing to /proc/fs/nfsd/unlock_filesystem, or issuing the NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink commands, causes NFSD to walk the NFSv4 client hash tables. Each handler gates that walk on the nn->nfsd_serv pointer to determine whether the service is active.
A listener added via portlist or a netlink listener_set sets nn->nfsd_serv before any NFSD thread starts. At that point, nfsd_startup_net() has not yet allocated nn->conf_id_hashtbl. When the admin unlock paths execute, they dereference a NULL hash table pointer and crash the kernel.
Root Cause
The root cause is an incorrect readiness gate. The nn->nfsd_serv pointer is set when the service structure is created, which occurs before the hash tables are allocated. The three unlock handlers relied on nn->nfsd_serv as a signal that the tables were live, but that assumption does not hold during the startup window between service creation and thread initialization [Null Pointer Dereference].
Attack Vector
A local administrator holding CAP_SYS_ADMIN can trigger the crash without starting the NFS server. The attacker adds a listener through portlist or a netlink listener_set to populate nn->nfsd_serv, then writes to /proc/fs/nfsd/unlock_filesystem or issues the corresponding netlink unlock command. The handler walks a NULL conf_id_hashtbl and the kernel panics.
The upstream fix replaces the nn->nfsd_serv check with NFSD_NET_UP. NFSD_NET_UP is set at the end of nfsd_startup_net() after the tables are allocated and cleared in nfsd_shutdown_net() before they are freed, both under nfsd_mutex. This correctly brackets the window in which the tables are live and also preserves an earlier post-shutdown use-after-free fix. See the upstream patches for details: Kernel Git Commit 0146467, Kernel Git Commit 104a512, and Kernel Git Commit 2f3e663.
Detection Methods for CVE-2026-90039
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing NFSD functions, conf_id_hashtbl, or the unlock code paths.
- System logs showing writes to /proc/fs/nfsd/unlock_filesystem prior to any NFSD threads being started.
- Audit records of NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink commands issued on hosts with no active NFS service.
Detection Strategies
- Enable kernel auditing (auditd) to log processes invoking CAP_SYS_ADMIN operations against NFSD procfs and netlink interfaces.
- Monitor dmesg and /var/log/kern.log for NULL pointer dereference stack traces originating in NFSD symbols.
- Track running kernel versions across the fleet and correlate against the patched commits listed in the upstream references.
Monitoring Recommendations
- Alert on unexpected kernel panics or reboots on hosts that export or may export NFS shares.
- Baseline which administrators legitimately interact with NFSD admin interfaces and flag deviations.
- Ingest kernel and audit logs into a centralized SIEM to correlate crashes with prior privileged NFSD interactions.
How to Mitigate CVE-2026-90039
Immediate Actions Required
- Apply the upstream Linux kernel patches that gate the three unlock paths on NFSD_NET_UP instead of nn->nfsd_serv.
- Restrict access to /proc/fs/nfsd/unlock_filesystem and the NFSD netlink family to trusted administrators only.
- Review which accounts hold CAP_SYS_ADMIN and remove the capability from processes that do not require it.
Patch Information
The fix is available in the following upstream kernel commits: Kernel Git Commit 0146467, Kernel Git Commit 104a512, and Kernel Git Commit 2f3e663. The change replaces the nn->nfsd_serv gate with NFSD_NET_UP, which is set only while the NFSv4 client hash tables are allocated. Track vendor kernel updates from your Linux distribution and apply the corresponding backport once available.
Workarounds
- Do not configure NFSD listeners on hosts that will not serve NFS, since adding a listener is a precondition for triggering the crash before threads start.
- Unload the nfsd kernel module on systems that do not require NFS export functionality.
- Limit local shell access on NFS servers to reduce exposure to local privileged attackers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.