CVE-2026-90236

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Release the export reference when reaping open stateids

nfs4_put_stid() releases the svc_export tracked in

nfs4_stid.sc_export, but free_ol_stateid_reaplist() frees open and

lock stateids by calling ->sc_free() directly, bypassing that path.

An open stateid takes an sc_export reference in nfs4_open() and a

lock stateid takes its own in init_lock_stateid(); both reach

free_ol_stateid_reaplist() through their normal teardown, the open

stateid via release_open_stateid() and the lock stateid via

nfsd4_release_lockowner(), each through put_ol_stateid_locked().

The reference is therefore never dropped, pinning the export and

blocking unmount for the lifetime of the stateid.

Release sc_export in free_ol_stateid_reaplist() the way

nfs4_put_stid() does. ->sc_free() runs once per stateid, and a

stateid reaches free_ol_stateid_reaplist() or nfs4_put_stid() but

never both, so the reference is dropped exactly once. Revoked

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References