CVE-2026-90236 Linux CVE debrief

Who should care

Defenders of Linux deployments using NFSD should assess exposure and prioritize verification of affected versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that their Linux deployments are not affected by this vulnerability or apply patches if necessary.

Why it matters

The Linux kernel vulnerability CVE-2026-90236 allows exports to be pinned and unmount to be blocked for the lifetime of a stateid. Defenders of Linux deployments using NFSD should assess exposure and prioritize verification of affected versions.

• Verification of affected Linux deployments and NFSD usage
• Potential pinning of exports and blocking of unmount operations
• Remediation priority for affected versions

Technical summary

The Linux kernel vulnerability CVE-2026-90236 occurs because nfs4_put_stid() releases the svc_export tracked in nfs4_stid.sc_export, but free_ol_stateid_reaplist() frees open and lock stateids by calling ->sc_free() directly, bypassing that path. An open stateid takes an sc_export reference in nfs4_open() and a lock stateid takes its own in init_lock_stateid(); both reach free_ol_stateid_reaplist() through their normal teardown.

Defensive priority

Defenders should assess exposure and prioritize verification of affected Linux deployments, especially those with NFSD usage.

Recommended defensive actions

• Assess exposure of Linux deployments using NFSD
• Verify affected versions and apply patches
• Monitor for potential pinning of exports and blocking of unmount operations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Two source references from the Linux kernel Git repository are also available. The vulnerability has been resolved through a patch that ensures the export reference is properly released. Defenders should verify affected Linux deployments and NFSD usage to assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.