UBUNTU-CVE-2026-90037: Use After Free
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn->closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundromat reaps timed-out entries, drops nn->clientlock, and calls nfs4putstid(), which dereferences the client through cllock. Nothing pins the client across that window, so a concurrent forceexpireclient() can free it and nfs4putstid() reads freed memory. destroyclient() hits the same race, walking clp->clopenowners without cllock. Pin the client with clrpcusers before dropping clientlock, and skip clients already expiring. destroyclient() then cleans up its own closelru entries through releaselastclosedstateid(), so teardown no longer races the laundromat.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Exposure is tied to the Linux NFS server component (NFSD), specifically its NFSv4 state handling. The affected Ubuntu kernel package families listed are linux, linux-aws, linux-azure, linux-gcp, linux-fips, linux-aws-fips, linux-azure-fips, and linux-gcp-fips.
What conditions are involved in triggering the race?
The race involves an NFSv4 open owner that remains on the close_lru after its final CLOSE. It occurs when the NFSD laundromat reaps that timed-out entry while another path concurrently force-expires and frees the associated client.
What is the security impact if the race is reached?
The vulnerable cleanup path can dereference a freed NFS client object, resulting in a use-after-free. The supplied severity data rates confidentiality, integrity, and availability impact as high.