CVE-2026-90038: NFSD: Prevent client use-after-free during export state revocation

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during export state revocation

nfsd4revokeexportstates() has the same use-after-free as nfsd4revokestates(): it drops nn->clientlock across revokeonestid() and the following read of clp->clminorversion, but the stateid reference it holds does not pin the client. A teardown racing the dropped lock can free the client while revokeonestid() still dereferences it.

exportfs -u drives this path through NFSDCMDUNLOCKEXPORT, so an administrator removing an export can race a client expiry.

Skip a client that is already expiring and otherwise pin it with clrpcusers under clientlock before dropping the lock, matching nfsd4revokestates().

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 16, 2026
CVE Published
via MITRE·10:33 AM
Data Sourced
via MITRE·10:33 AM
Description

Frequently Asked Questions

1

Who is exposed to this race condition?

Systems running the Linux kernel NFSD service are exposed when an administrator removes an NFS export and a client expiry or teardown occurs concurrently. The affected path is driven by exportfs -u through NFSD_CMD_UNLOCK_EXPORT.

2

What conditions are needed to trigger the issue?

An administrator must remove an export while NFSD is revoking that export's state, and a client teardown must race during the period where client_lock is dropped. The race can free the client while revoke_one_stid() continues to dereference it.

3

What can be done if the fix cannot be applied immediately?

Avoid removing NFS exports with exportfs -u while affected NFSD clients may be expiring or undergoing teardown. The provided data does not identify another mitigation.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203