NFSD: Prevent client use-after-free during close_lru reaping (CVE-2026-90037) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-90037

NFSD: Prevent client use-after-free during close_lru reaping

Answer in brief

CVE-2026-90037 records a Unknown severity vulnerability in NFSD: Prevent client use-after-free during close_lru reaping. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 16, 2026Updated Sep 16, 2026Source checked Sep 16, 2026First seen by HOL Sep 16, 2026Material review Sep 16, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=217526e7ecc9f6f243e976772e81eab7ab986a4c <83dd59ac1c3455c2c7d8ddb582d980a13199b9b3 \|\| >=217526e7ecc9f6f243e976772e81eab7ab986a4c <e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1 \|\| >=217526e7ecc9f6f243e976772e81eab7ab986a4c <2330b788d732f43668b965b3105b37ceb276dfea	83dd59ac1c3455c2c7d8ddb582d980a13199b9b3, e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1, 2330b788d732f43668b965b3105b37ceb276dfea
Linux/Linuxgeneric	3.17	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 16, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during close_lru reaping An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid in oo_last_closed_stid, holding only a raw pointer to its nfs4_client. The laundromat reaps timed-out entries, drops nn->client_lock, and calls nfs4_put_stid(), which dereferences the client through cl_lock. Nothing pins the client across that window, so a concurrent force_expire_client() can free it and nfs4_put_stid() reads freed memory. __destroy_client() hits the same race, walking clp->cl_openowners without cl_lock. Pin the client with cl_rpc_users before dropping client_lock, and skip clients already expiring. __destroy_client() then cleans up its own close_lru entries through release_last_closed_stateid(), so teardown no longer races the laundromat.

Quoted source text, attributed separately from HOL analysis.