CVE-2026-90038 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during export state revocation
nfsd4_revoke_export_states() has the same use-after-free as nfsd4_revoke_states(): it drops nn->client_lock across revoke_one_stid() and the following read of clp->cl_minorversion, but the stateid reference it holds does not pin the client. A teardown racing the dropped lock can free the client while revoke_one_stid() still dereferences it.
exportfs -u drives this path through NFSD_CMD_UNLOCK_EXPORT, so an administrator removing an export can race a client expiry.
Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Network File System daemon (NFSD) module contains a critical concurrency flaw within its export state revocation logic. Specifically, the function nfsd4_revoke_export_states() exhibits a use-after-free vulnerability that mirrors issues previously identified in nfsd4_revoke_states(). The core technical deficiency lies in how client references are managed during the revocation process. When nfssd4_revoke_export_states() executes revoke_one_stid(), it temporarily releases nn->client_lock to allow other operations to proceed. However, this release occurs before a subsequent read of clp->cl_minorversion. Crucially, while the code holds a reference to the state identifier (stateid), it fails to pin the associated client structure itself. This creates a window where the lock is dropped but the client object remains vulnerable to deallocation by concurrent teardown operations that race against this gap in synchronization.
The operational impact of this vulnerability arises when an administrator initiates the removal of an NFS export using the exportfs -u command, which triggers the NFSD_CMD_UNLOCK_EXPORT path. During this administrative action, if a client is simultaneously undergoing expiry or state revocation, the racing teardown thread can free the client structure while revoke_one_stid() still attempts to dereference it via clp->cl_minorversion. This race condition leads to use-after-free memory corruption, which typically results in kernel panics, system crashes, or potentially exploitable arbitrary code execution if an attacker can influence the timing and content of the freed memory regions. The severity is heightened by the fact that this occurs during routine administrative tasks involving export management, making it accessible to local users with appropriate privileges rather than requiring external network exploitation alone.
From a classification perspective, this vulnerability aligns with CWE-416: Use After Free, as the system accesses memory after it has been freed due to improper synchronization of reference counting and locking mechanisms. In terms of adversary behavior mapping under MITRE ATT&CK for Enterprise or ICS, this flaw relates to Tactic TA0005: Defense Evasion or potentially TA0004: Privilege Escalation if the crash can be leveraged to gain higher privileges through kernel memory corruption techniques such as heap spraying or specific exploitation of slab allocator behavior. The vulnerability highlights a common pitfall in Linux kernel development where holding one type of reference (stateid) is mistakenly assumed to provide sufficient protection for related structures (client object) without explicit pinning via rpc_users counters.
To mitigate this issue, the fix involves modifying the synchronization logic within nfsd4_revoke_export_states() to match the safer pattern established in nfsd4_revoke_states(). The solution requires skipping any client that is already marked as expiring to avoid racing with teardown processes. Furthermore, before dropping nn->client_lock, the code must explicitly pin the client by incrementing its cl_rpc_users counter while holding the lock. This ensures that the client structure remains valid and cannot be freed until after the critical section involving the read of clp->cl_minorversion is completed. Administrators should apply kernel updates containing this patch immediately to prevent potential denial-of-service conditions or stability issues during NFS export management operations. Regular auditing of concurrent locking patterns in network filesystem daemons is recommended to identify similar reference counting discrepancies before they manifest as exploitable vulnerabilities.