CVE-2026-90039

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Guard admin state-revocation walks with NFSD_NET_UP

Writing to /proc/fs/nfsd/unlock_filesystem, or sending the

NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command,

walks the NFSv4 client hash tables to revoke open state and cancel

async COPY operations. All three handlers gate that walk on

nn->nfsd_serv, but a listener added via portlist or netlink

listener_set sets nn->nfsd_serv before any nfsd thread starts.

nfsd_startup_net() has not yet allocated nn->conf_id_hashtbl, so the

walkers dereference a NULL table. A local administrator with

CAP_SYS_ADMIN can crash the kernel this way without ever starting the

server.

nn->nfsd_serv is set when the service is created, which precedes

table allocation. NFSD_NET_UP instead brackets the window where the

tables are live: set at the end of nfsd_startup_net() and cleared in

nfsd_shutdown_net() after they are freed, both under nfsd_mutex.

Gating the thr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References