CVE-2026-90039 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Guard admin state-revocation walks with NFSD_NET_UP
Writing to /proc/fs/nfsd/unlock_filesystem, or sending the NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command, walks the NFSv4 client hash tables to revoke open state and cancel async COPY operations. All three handlers gate that walk on nn->nfsd_serv, but a listener added via portlist or netlink listener_set sets nn->nfsd_serv before any nfsd thread starts. nfsd_startup_net() has not yet allocated nn->conf_id_hashtbl, so the walkers dereference a NULL table. A local administrator with CAP_SYS_ADMIN can crash the kernel this way without ever starting the server.
nn->nfsd_serv is set when the service is created, which precedes table allocation. NFSD_NET_UP instead brackets the window where the tables are live: set at the end of nfsd_startup_net() and cleared in nfsd_shutdown_net() after they are freed, both under nfsd_mutex. Gating the three unlock paths on NFSD_NET_UP fixes the startup-time NULL dereference while preserving the earlier post-shutdown use-after-free fix.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified involves a critical null pointer dereception within the Linux kernel's NFS server daemon implementation, specifically affecting the state revocation mechanisms for NFSv4 clients. The core issue arises from an incorrect synchronization of resource initialization and access control during the network namespace setup process. When an administrator attempts to revoke admin state by writing to /proc/fs/nfsd/unlock_filesystem or sending specific netlink commands such as NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT, the kernel executes a walk through NFSv4 client hash tables to revoke open states and cancel asynchronous COPY operations. These handlers currently check for the existence of nn->nfsd_serv to determine if they should proceed with this state revocation logic. However, there is a race condition in the initialization sequence where nn->nfsd_serv is set when the service structure is created, which occurs before the actual hash tables like nn->conf_id_hashtbl are allocated by nfsd_startup_net(). Consequently, if these unlock commands are issued while the listener has been added via portlist or netlink but before any nfsd threads have started and fully initialized the data structures, the code attempts to dereference a NULL table pointer. This results in an immediate kernel panic or crash, effectively denying service and potentially compromising system stability without requiring the NFS server to be actively running.
From a technical perspective, this flaw represents a classic initialization race condition where access control checks are not aligned with resource availability windows. The existing check for nn->nfsd_serv is insufficient because it does not guarantee that all dependent data structures have been allocated and initialized. The fix involves replacing the coarse-grained check on nfsd_serv with a more precise gate using NFSD_NET_UP, which accurately brackets the window where the hash tables are live and safe to access. This flag is set at the end of nfsd_startup_net() after table allocation and cleared in nfsd_shutdown_net() after they are freed, ensuring that state revocation operations only proceed when the underlying data structures are valid. This approach preserves previous fixes for use-after-free vulnerabilities while eliminating the new null pointer dereference path introduced by early listener registration. The vulnerability allows a local administrator with CAP_SYS_ADMIN privileges to trigger this crash without ever starting the server, highlighting a gap in privilege boundary enforcement where administrative actions can destabilize the kernel even when core services are not yet active.
In terms of industry standards and threat modeling, this vulnerability aligns with CWE-476, which describes a NULL Pointer Dereference, as it involves accessing memory through an uninitialized or null pointer leading to undefined behavior and system crash. Furthermore, from the perspective of the MITRE ATT&CK framework, this issue facilitates Local Privilege Escalation via Denial of Service (DoS) techniques, specifically falling under T1053 Scheduled Task/Job as it involves administrative commands that can be triggered by users with high-level privileges to disrupt system availability. Although the attacker requires CAP_SYS_ADMIN, which is a very high privilege level typically reserved for root or trusted administrators, the ability to crash the kernel through specific configuration changes rather than active exploitation of running services makes this particularly dangerous in environments where NFS configurations are managed dynamically or via automated scripts that might trigger these unlock commands during setup phases.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that introduces the NFSD_NET_UP guard for the relevant netlink and procfs handlers. System administrators should ensure their kernels are updated to versions containing this fix, particularly if they utilize dynamic NFS server configuration or automated provisioning tools that interact with /proc/fs/nfsd interfaces during initialization sequences. Additionally, monitoring system logs for kernel panics associated with nfsd state revocation can help identify instances where this vulnerability might have been triggered in unpatched environments. For organizations running critical NFS infrastructure, it is advisable to review any custom scripts or automation tools that interact with NFSD configuration endpoints and ensure they account for the full initialization lifecycle of the service rather than assuming immediate availability upon listener registration.