CVE-2026-90151 Linux CVE debrief

Who should care

Linux kernel maintainers, NFSv4 deployment administrators, and security teams responsible for Linux kernel patching and vulnerability management. They should assess exposure, prioritize verification, and apply patches or compensating controls as needed. Linux kernel deployments using NFSv4 should verify Linux kernel versions and NFSv4 usage.

Why it matters

CVE-2026-90151 is a publish-before-free lifetime bug in the Linux kernel's NFSv4 callback identifier handling. Linux kernel deployments using NFSv4 should assess exposure, prioritize verification, and apply patches or compensating controls as needed.

• Verify Linux kernel versions for potential callback identifier handling issues
• Assess exposure for Linux kernel deployments using NFSv4
• Prioritize patching or applying compensating controls for affected versions
• Monitor for potential callback identifier handling issues

Technical summary

The Linux kernel's NFSv4 callback identifier handling has a publish-before-free lifetime bug. When nfs4_alloc_client() allocates an NFSv4.0 callback identifier before completing client setup, and a later initialization step fails, the error path frees the nfs_client directly with nfs_free_client(), bypassing nfs_put_client(). This can leave cb_ident_idr pointing at a freed nfs_client. Affected Linux kernel versions require verification from official sources. Assess exposure and prioritize verification for Linux kernel deployments using NFSv4.

Defensive priority

Verify Linux kernel versions and NFSv4 usage; apply patches or compensating controls

Recommended defensive actions

• Verify Linux kernel version and NFSv4 usage
• Apply patches or compensating controls
• Monitor for potential callback identifier handling issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The bug was found by a local static-analysis checker and confirmed by manual inspection. Official Linux kernel sources and commit hashes are provided. Affected Linux kernel versions require verification from official sources. Linux kernel deployments using NFSv4 should assess exposure, prioritize verification, and apply patches or compensating controls as needed. The publish-before-free lifetime bug in NFSv4 callback identifier handling can leave cb_ident_idr pointing at a freed nfs_client.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.