CVE-2026-90236: NFSD: Release the export reference when reaping open stateids
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Release the export reference when reaping open stateids
nfs4putstid() releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist() frees open and lock stateids by calling ->scfree() directly, bypassing that path. An open stateid takes an scexport reference in nfs4open() and a lock stateid takes its own in initlockstateid(); both reach freeolstateidreaplist() through their normal teardown, the open stateid via releaseopenstateid() and the lock stateid via nfsd4releaselockowner(), each through putolstateidlocked(). The reference is therefore never dropped, pinning the export and blocking unmount for the lifetime of the stateid.
Release scexport in freeolstateidreaplist() the way nfs4putstid() does. ->scfree() runs once per stateid, and a stateid reaches freeolstateidreaplist() or nfs4putstid() but never both, so the reference is dropped exactly once. Revoked stateids reach this path with scexport already cleared by dropstidexport(), so they are skipped rather than double-freed.
nfs4putstid() itself read scexport before acquiring cllock. dropstidexport() clears that field and releases the reference under cllock, so a concurrent revocation could drop the export in the window between the read and the final put, releasing the same reference twice. Read scexport while cllock is held so the two paths serialize and the reference is released exactly once.
Event History
Frequently Asked Questions
Which NFSD activity is affected?
The issue affects open and lock stateids that hold an export reference and are later freed through the reap-list teardown path. Open stateids reach that path through release_open_stateid(), while lock stateids reach it through nfsd4_release_lockowner().
What is the operational impact of the leaked reference?
The export remains pinned because its reference is not dropped during this teardown path. This can prevent the export from being unmounted for the lifetime of the affected stateid.