CVE-2026-90148: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: Fix incorrect argument passed to nfs4deletelease() in nfs4addlease()
When nfs4addlease() races with a delegation return, it calls nfs4deletelease() to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a NULL priv eventually leads to a NULL pointer dereference in genericsetlease().
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the NULL pointer dereference?
The issue requires nfs4_add_lease() to race with a delegation return. In that cleanup path, nfs4_add_lease() can pass a legitimately NULL priv argument to nfs4_delete_lease(), ultimately causing a NULL pointer dereference in generic_setlease().
Which systems are exposed?
Systems using the Linux kernel's NFSv4 functionality are relevant, specifically where the affected lease-addition and delegation-return race can occur. The provided information does not identify affected kernel versions or configuration defaults.
How can I determine whether a crash may be related to this issue?
Look for a NULL pointer dereference involving generic_setlease() in a system using NFSv4, particularly when NFSv4 lease handling and delegation returns are occurring. The supplied data does not provide a specific log signature or detection method.