CVE-2026-90148 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
When nfs4_add_lease() races with a delegation return, it calls nfs4_delete_lease() to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a NULL priv eventually leads to a NULL pointer dereference in generic_setlease().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified involves a critical race condition within the Network File System version 4 implementation, specifically affecting the lease management subsystem during delegation operations. The core issue resides in the nfs4_add_lease function, which is responsible for establishing file leases to ensure data consistency and prevent conflicting writes from multiple clients. Under normal circumstances, this function operates correctly; however, a specific timing scenario arises when the addition of a new lease races with an ongoing delegation return operation initiated by another process or thread. In such scenarios, the system attempts to clean up existing state by invoking nfs4_delete_lease. The flaw lies in the argument passed during this cleanup call, where the function erroneously utilizes a pointer named priv that may legitimately be NULL at that specific point of execution due to the asynchronous nature of the race condition.
This incorrect parameter passing leads directly to a null pointer dereference within the generic_setlease kernel routine. When nfs4_delete_lease attempts to interact with lease management structures using this invalid reference, it triggers an access violation in kernel space. Because this occurs at the core level of the operating system responsible for file system operations, the immediate operational impact is typically a kernel panic or system crash, resulting in a denial of service for all users and services relying on that host. In less severe instances where fault tolerance mechanisms intervene, it could lead to data corruption within NFS metadata structures or unpredictable behavior in client-server interactions, compromising both availability and integrity.
From a vulnerability classification perspective, this flaw aligns with CWE-476, which denotes a NULL pointer dereference, as the root cause is the improper handling of a null reference leading to an out-of-bounds access or crash. Furthermore, within the context of attack vectors, this scenario reflects aspects of CWE-362, specifically concurrent execution using shared resources without proper synchronization, highlighting how race conditions in kernel subsystems can be exploited through timing-based triggers rather than direct input manipulation. The ATT&CK framework categorizes such behaviors under techniques related to resource exhaustion or system crash exploitation, although the primary impact here is stability degradation rather than privilege escalation.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided kernel patches that correct the logic within nfs4_add_lease to ensure null checks are performed before passing arguments to deletion routines. System administrators should prioritize updating their Linux kernels to versions where this race condition has been resolved, ensuring that the lease management code properly validates pointers regardless of concurrent delegation states. Additionally, monitoring system logs for oops messages or kernel panics related to NFS operations can help identify affected systems in environments where patching is delayed. Implementing strict access controls and limiting exposure of NFS services to untrusted networks reduces the attack surface, although this vulnerability stems from internal logic errors rather than external input exploitation, making timely software updates the most effective defense mechanism against potential denial-of-service impacts.