CVE-2026-90036 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during blocked-lock reaping
A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops the owner reference held through flc_owner, and the final nfs4_put_stateowner() takes the client's cl_lock. Because the laundromat detaches the nbl first, __destroy_client() no longer finds it, so a concurrent force_expire_client() can free the client before nfs4_put_stateowner() runs, dereferencing cl_lock in freed memory.
Pin the client with cl_rpc_users before dropping nn->blocked_locks_lock, and skip clients already expiring, whose blocked locks __destroy_client() frees while holding an owner reference. Take nn->client_lock outside nn->blocked_locks_lock. Every other site holds nn->blocked_locks_lock as a leaf, acquiring no further lock, so placing nn->client_lock outside it cannot form a lock-order cycle.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's Network File System daemon (NFSD) component represents a critical use-after-free condition arising from improper reference counting and locking synchronization during the lifecycle management of NFSv4 clients. This flaw specifically impacts the mechanism used to reap blocked locks, which are pending lock requests that cannot be granted immediately due to conflicts with other existing locks on shared resources. The core issue stems from how bare lock owners are handled within the kernel's state management subsystem. A bare lock owner is defined as a structure whose only remaining reference count is tied to its presence in the global list of blocked locks, known as nn->blocked_locks_lru. Crucially, while this structure holds a raw pointer to the associated nfs4_client object, it does not hold an explicit reference that prevents the client from being freed by other concurrent operations. This architectural oversight creates a race condition window where the integrity of memory references can be compromised during cleanup procedures.
The operational sequence leading to exploitation involves the per-net laundromat process, which is responsible for periodically scanning and cleaning up stale or expired stateful objects in the kernel. When this background task reaps a blocked lock, it proceeds to free the associated nfs4_lock_block structure (nbl). This deallocation triggers a decrement of the reference count held through flc_owner within the lock owner structure. Consequently, the final call to nfs4_put_stateowner() is executed, which attempts to acquire the client's cl_lock mutex to safely update or destroy state information. However, because the laundromat detaches the blocked lock from its tracking list before completing the cleanup, the __destroy_client function no longer locates this specific locked entry when it runs concurrently. This detachment allows a separate force_expire_client() operation to determine that all references are gone and proceed to free the client structure entirely. If this freeing occurs while nfs4_put_stateowner is attempting to access cl_lock within the now-deallocated memory region, a use-after-free condition is triggered.
The impact of this vulnerability is severe, as it allows for potential kernel panic or system instability due to invalid memory dereferences. In more sophisticated attack scenarios, an attacker who can influence NFS lock operations might exploit this race condition to achieve arbitrary code execution with kernel privileges. The lack of proper reference pinning means that the lifetime of the client object is not strictly synchronized with the lifecycle of its associated blocked locks. This disconnect violates fundamental principles of safe concurrent programming in the Linux kernel, where all shared data structures must have their lifetimes explicitly managed through atomic reference counting or strict locking hierarchies to prevent access after deallocation. The vulnerability highlights a complex interaction between different subsystems managing NFS state, specifically the interplay between lock blocking mechanisms and client expiration logic.
To mitigate this issue, the resolution involves restructuring the locking order and introducing explicit lifetime management for clients during blocked-lock reaping operations. Specifically, the kernel code now pins the client by incrementing its cl_rpc_users reference count before dropping the nn->blocked_locks_lock mutex. This ensures that the client structure remains valid in memory throughout the duration of the cleanup process, preventing force_expire_client from freeing it prematurely. Additionally, the fix implements logic to skip clients that are already in an expiring state, as __destroy_client handles their blocked locks while holding an owner reference, thereby avoiding redundant or conflicting operations. The patch also adjusts the lock acquisition order by taking nn->client_lock outside of nn->blocked_locks_lock. Since all other code sites treat nn->blocked_locks_lock as a leaf node without acquiring further locks, this reordering does not introduce new deadlock risks but rather establishes a consistent and safe locking hierarchy that prevents race conditions during state owner cleanup.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, which describes the error of using memory after it has been freed, often leading to crashes or arbitrary code execution. The attack vector relates to ATT&CK technique T1059, Command and Scripting Interpreter, if exploited for initial access via NFS services, but more accurately maps to privilege escalation vectors where kernel vulnerabilities are leveraged to gain higher system privileges. The fix demonstrates the importance of rigorous lock ordering and reference counting in complex stateful network protocols like NFSv4. By ensuring that client objects cannot be freed while their associated locks are still being processed for reaping, the patch restores memory safety guarantees within the NFSD subsystem. This correction is essential for maintaining the stability and security of Linux-based file servers exposed to untrusted or potentially malicious clients attempting to manipulate lock states.