CVE-2026-90036 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches or mitigations as necessary. Additionally, operators of Linux-based infrastructure, platform administrators, vulnerability management teams, and security teams should evaluate the potential impact on their systems and take appropriate measures to mitigate the vulnerability.

Why it matters

This vulnerability in the Linux kernel's NFSD can lead to system crashes or potential code execution if exploited. Linux kernel developers, maintainers, and users should assess exposure and apply patches or mitigations promptly to prevent exploitation.

• Potential system crashes or instability due to use-after-free conditions.
• Possible code execution or elevation of privileges.
• Need for prompt patching or mitigation to prevent exploitation.
• Importance of monitoring Linux kernel systems for unusual behavior.

Technical summary

The vulnerability is caused by a use-after-free condition in the Linux kernel's NFSD when handling blocked locks. A lock owner holds a raw pointer to its nfs4_client, but this reference does not keep the client alive. When the per-net laundromat reaps the lock, freeing the nbl drops the owner reference, and the final nfs4_put_stateowner() takes the client's cl_lock. If the laundromat detaches the nbl first, __destroy_client() no longer finds it, allowing a concurrent force_expire_client() to free the client before nfs4_put_stateowner() runs, causing a crash or potential code execution.

Defensive priority

High

Recommended defensive actions

• Review and apply the kernel patches to prevent use-after-free conditions.
• Monitor Linux kernel systems for unusual behavior or crashes.
• Ensure systems are updated with the latest security patches.
• Perform a thorough review of system logs to identify potential exploitation attempts.
• Verify that compensating controls are in place for exposed systems.
• Conduct an asset inventory to identify all affected systems.
• Track exceptions and retest remediated assets to ensure patching effectiveness.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected systems. However, specific details about the exploitation of this vulnerability in the wild are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.