CVE-2026-90037 Linux CVE debrief

Who should care

Linux kernel maintainers, system administrators, and users who rely on the Linux kernel should be aware of this vulnerability and take steps to mitigate it. The vulnerability affects Linux kernel deployments, particularly those with NFSD enabled. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to protect their systems.

Why it matters

A use-after-free vulnerability in the Linux kernel's NFSD allows a client to access freed memory, potentially leading to a crash or other unexpected behavior. Linux kernel maintainers, system administrators, and users who rely on the Linux kernel should be aware of this vulnerability and take steps to mitigate it.

• Potential system crashes or unexpected behavior.
• Possible exposure of sensitive information.
• Need for patching and updating the Linux kernel.
• Verification of system integrity and monitoring for suspicious activity.

Technical summary

The vulnerability is caused by a race condition between the laundromat reaping timed-out entries and a concurrent force_expire_client() call, which can free the client. The laundromat reaps timed-out entries, drops nn->client_lock, and calls nfs4_put_stid(), which dereferences the client through cl_lock. Nothing pins the client across that window, so a concurrent force_expire_client() can free it and nfs4_put_stid() reads freed memory.

Defensive priority

High

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Ensure that the Linux kernel is updated to the latest version.
• Monitor the system for any suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is described in the Linux kernel's official repository. The CVE record and NVD entry provide additional information about the vulnerability. To verify the vulnerability, defenders should review the Linux kernel's official repository and the CVE record. They should also monitor the system for any suspicious activity and ensure that the Linux kernel is updated to the latest version. The vulnerability is caused by a race condition between the laundromat reaping timed-out entries and a concurrent force_expire_client() A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.