CVE-2026-90151

CriticalCVSS 9.8

Published: 17/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

In the Linux kernel NFSv4 client, nfs4_alloc_client() allocates an NFSv4.0 callback identifier before finishing client setup. If a later initialization step fails, the error path frees the nfs_client directly via nfs_free_client(), bypassing removal of the cb_ident_idr entry and leaving a stale pointer to freed memory.

Risk Assessment

A later NFSv4.0 callback lookup by cb_ident can reference freed memory, leading to a kernel crash or potential use-after-free.

Recommendation

Update the Linux kernel to a version with the fix that removes the callback identifier from the IDR before freeing the client in the allocation failure path.

Other vulnerabilities in Linux kernel (NFSv4)

CVE-2026-90148Unknown
In the Linux kernel NFSv4 client, nfs4_add_lease() calls nfs4_delete_lease() with the priv argument, which can legitimately be NULL, when racing with a delegation return. Passing NULL eventually leads to a NULL pointer dereference in generic_setlease().

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4_alloc_client() allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the nfs_client directly with nfs_free_client(). That bypasses nfs_put_client(), which is where the callback IDR entry is removed during normal teardown. A failed allocation can therefore leave cb_ident_idr pointing at a freed nfs_client. A later NFSv4.0 callback lookup by cb_ident would find the stale pointer and take a reference to it. Make the callback IDR removal helper callable by the allocation failure path, and remove the callback identifier before freeing the client. This was found by a local static-analysis checker for publish-before-free lifetime bugs and confirmed by manual inspection.