CVE-2026-90148

Unknown

Published: 17/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Summary

In the Linux kernel NFSv4 client, nfs4_add_lease() calls nfs4_delete_lease() with the priv argument, which can legitimately be NULL, when racing with a delegation return. Passing NULL eventually leads to a NULL pointer dereference in generic_setlease().

Risk Assessment

This can cause a kernel oops during NFSv4 file lease operations, resulting in an NFS client outage.

Recommendation

Update the Linux kernel to a version with the fix that passes the correct argument to nfs4_delete_lease() in nfs4_add_lease().

Other vulnerabilities in Linux kernel (NFSv4)

CVE-2026-90151Critical
In the Linux kernel NFSv4 client, nfs4_alloc_client() allocates an NFSv4.0 callback identifier before finishing client setup. If a later initialization step fails, the error path frees the nfs_client directly via nfs_free_client(), bypassing removal of the cb_ident_idr entry and leaving a stale pointer to freed memory.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() When nfs4_add_lease() races with a delegation return, it calls nfs4_delete_lease() to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a NULL priv eventually leads to a NULL pointer dereference in generic_setlease().