CVE-2026-90039 Linux CVE debrief

Who should care

Linux administrators and users with CAP_SYS_ADMIN privileges should verify and apply the patch to prevent potential local denial-of-service attacks. Additionally, security teams and vulnerability management teams should review the vulnerability and apply necessary mitigations to prevent exploitation.

Why it matters

Linux administrators should verify and apply the patch to prevent potential local denial-of-service attacks. This vulnerability allows a local administrator with CAP_SYS_ADMIN to crash the kernel.

• Local denial-of-service attacks may be possible.
• Verification of patch application is necessary to prevent potential crashes.
• Restricting CAP_SYS_ADMIN privileges can help mitigate the vulnerability.

Technical summary

The Linux kernel vulnerability allows a local administrator with CAP_SYS_ADMIN to crash the kernel by writing to /proc/fs/nfsd/unlock_filesystem, sending the NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command. This issue is due to a NULL pointer dereference in the NFSv4 client hash tables. The vulnerability can be resolved by gating the admin state-revocation walks with NFSD_NET_UP, ensuring that the tables are live and accessible during the walk. This fix prevents the NULL pointer dereference and subsequent kernel crash.

Defensive priority

Linux administrators should verify and apply the patch to prevent potential local denial-of-service attacks.

Recommended defensive actions

• Verify and apply the patch to prevent potential local denial-of-service attacks.
• Monitor Linux kernel updates for potential security patches.
• Restrict CAP_SYS_ADMIN privileges to trusted users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and potential impact. The Linux kernel vulnerability is caused by a NULL pointer dereference in the NFSv4 client hash tables. The issue can be resolved by applying the patch provided by the vendor. Evidence of the vulnerability's existence and impact can be found in the CVE record and NVD entry. Defenders should verify the patch application to prevent potential local denial-of-service attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.