Linux kernel NFSD: client use-after-free when an export is removed during client expiry

CVSS 9.8CVE-2026-90038Kernel, userspace & hypervisorcurated

Impact

nfsd4_revoke_export_states() drops nn->client_lock across revoke_one_stid() and the subsequent read of clp->cl_minorversion, but the stateid reference it holds does not pin the nfs4_client, so a teardown racing that window can free the client while it is still dereferenced. Unlike the laundromat races in this same series, this one is driven by an administrator: exportfs -u reaches this path through NFSD_CMD_UNLOCK_EXPORT, so routine export maintenance racing a client expiry is the trigger. That makes it a self-inflicted risk on a fileserver - reconfiguring exports while clients are timing out can corrupt server state. The 9.8/AV:N score is the kernel CNA's blanket value and does not reflect the administrator-initiated trigger.

Who can reach it

Local administrative action on the NFS server (exportfs -u or equivalent export removal) racing a client expiry. Not reachable by an unprivileged remote client on its own, though remote clients supply the state being revoked.

What to do

Apply the stable-kernel update carrying the two listed commits and reboot the NFS server nodes. Until patched, avoid removing exports on a live server while clients may be expiring - do export changes in a quiet window. No fixed distribution version is stated in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-90038 https://git.kernel.org/stable/c/2108de53568a64936a0da3e04d85c35df98d3fb6 https://git.kernel.org/stable/c/c05ae58fe06ce2ac34312f649e71c3596bdde358

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.