Linux kernel NFSD: client use-after-free when the laundromat reaps close_lru open owners

Impact

An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid and only a raw pointer to the nfs4_client. The laundromat drops nn->client_lock and calls nfs4_put_stid(), which reaches the client through cl_lock with nothing pinning it, so a concurrent force_expire_client() can free the client underneath - and __destroy_client() races the same way by walking clp->cl_openowners without cl_lock. This is a distinct path from the blocked-lock race (see CVE-2026-90036), driven by normal open/close traffic rather than locking. On a fleet where NFS serves datasets and checkpoints, corruption or a panic in the server halts every node mounting it. The 9.8/AV:N score is the kernel CNA's default; exploitation requires winning a teardown race, not a single remote request.

Who can reach it

Remote NFS clients performing ordinary open and close operations against an export, racing a client expiry. No account on the server host is required beyond being allowed to mount.

What to do

Take the stable-kernel update with the listed commits and reboot the NFS server nodes - the fix is in the in-kernel nfsd, so restarting userspace NFS services changes nothing. Schedule the reboot as a fileserver outage window. The record names no fixed distribution version.

References

Related entries

• Linux kernel NFSD: client use-after-free when an export is removed during client expiryCVE-2026-90038 · Linux kernel NFSD (nfsd4_revoke_export_states, export unlock path)Critical
• Linux kernel CephFS client: oops decrypting filenames from vmalloc() message buffersCVE-2026-90042 · Linux kernel CephFS client (ceph_fname_to_usr, fscrypt filename decryption)Critical
• Linux sunrpc xprtsock: unannotated socket callback replace/restore leaves a stale-pointer raceCVE-2026-90235 · Linux kernel sunrpc xprtsock (shared sk_data_ready / sk_write_space callbacks)Critical
• Linux kernel SUNRPC server GSS auth (svcauth_gss_decode_credbody): svcauth_gss_decode_credbody() fills the caller'sCVE-2026-93207 · Linux kernel SUNRPC server GSS auth (svcauth_gss_decode_credbody)Critical
• Linux kernel libiscsi: target-supplied ITT in a Reject PDU completes an arbitrary taskCVE-2026-99153 · Linux kernel libiscsi (Reject PDU ITT handling)Critical
• Linux kernel libiscsi: negative task index from parse_pdu_itt reads before the command arrayCVE-2026-99154 · Linux kernel libiscsi / be2iscsi (negative PDU task index)Critical