CVE-2026-90038: NFSD: Prevent client use-after-free during export state revocation
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during export state revocation
nfsd4revokeexportstates() has the same use-after-free as nfsd4revokestates(): it drops nn->clientlock across revokeonestid() and the following read of clp->clminorversion, but the stateid reference it holds does not pin the client. A teardown racing the dropped lock can free the client while revokeonestid() still dereferences it.
exportfs -u drives this path through NFSDCMDUNLOCKEXPORT, so an administrator removing an export can race a client expiry.
Skip a client that is already expiring and otherwise pin it with clrpcusers under clientlock before dropping the lock, matching nfsd4revokestates().
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this race condition?
Systems running the Linux kernel NFSD service are exposed when an administrator removes an NFS export and a client expiry or teardown occurs concurrently. The affected path is driven by exportfs -u through NFSD_CMD_UNLOCK_EXPORT.
What conditions are needed to trigger the issue?
An administrator must remove an export while NFSD is revoking that export's state, and a client teardown must race during the period where client_lock is dropped. The race can free the client while revoke_one_stid() continues to dereference it.
What can be done if the fix cannot be applied immediately?
Avoid removing NFS exports with exportfs -u while affected NFSD clients may be expiring or undergoing teardown. The provided data does not identify another mitigation.