Look up another CVE · open CVE-2026-90037 in the interactive tracker
CVE-2026-90037
NFSD: Prevent client use-after-free during close_lru reaping
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem fs/nfsd. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90037 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid in oo_last_closed_stid, holding only a raw pointer to its nfs4_client. The laundromat reaps timed-out entries, drops nn->client_lock, and calls nfs4_put_stid(), which dereferences the client through cl_lock. Nothing pins the client across that window, so a concurrent force_expire_client() can free it and nfs4_put_stid() reads freed memory. __destroy_client() hits the same race, walking clp->cl_openowners without cl_lock. Pin the client with cl_rpc_users before dropping client_lock, and skip clients already expiring. __destroy_client() then cleans up its own close_lru entries through release_last_closed_stateid(), so teardown no longer races the laundromat.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/nfsd/nfs4state.c
- What this is
- KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on fs/nfsd/ · linux-nfs@vger.kernel.org · Supported
- Kernel module
- nfsd
Check it on the machine
grep -wE 'CONFIG_NFSD|CONFIG_NFSD_V4' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nfsdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NFSD, CONFIG_NFSD_V4
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.48%, higher than 40.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/nfsd
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.17 | 6.12.111 | 076348222782 |
| 3.17 | 6.18.51 | 83dd59ac1c34 |
| 3.17 | 7.2.5 | e57a9ed34ea8 |
| 3.17 | 7.3 | 2330b788d732 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- nfsd is the in-kernel NFS server. A remote NFSv4.0 client reaches the UAF over TCP/UDP 2049: CLOSE places the openowner on nn->close_lru, and SETCLIENTID_CONFIRM (ALLOWED_WITHOUT_FH) calls expire_client() while nfs4_laundromat() drops client_lock and nfs4_put_stid() uses the unpinned nfs4_client.
- AC:LAttack complexity, low
- The attacker drives both sides: OPEN/CLOSE compounds fill close_lru so the laundromat drops client_lock once per nfs4_put_stid(), and concurrent SETCLIENTID_CONFIRM with matching AUTH_SYS creds replaces the client via expire_client(). FATTR4_LEASE_TIME times the window; flooding close_lru widens it; the race is retryable.
- PR:NPrivileges required, none
- Typical nfsd deployments use AUTH_SYS/AUTH_NULL, so RPC uids are self-asserted. SETCLIENTID and SETCLIENTID_CONFIRM are ALLOWED_WITHOUT_FH; any host allowed by the export can OPEN/CLOSE and replace the client with no local account or capability on the NFS server.
- UI:NUser interaction, none
- The attacker issues the NFSv4.0 compounds (SETCLIENTID, OPEN, CLOSE, RENEW, SETCLIENTID_CONFIRM) itself. No administrator or other user on the victim server must mount a filesystem, write nfsdfs ctl, or otherwise interact.
- S:UScope, unchanged
- The use-after-free is of the nfsd nfs4_client object (client_slab) in the NFS server kernel. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- After free_client() kmem_cache_free()s the nfs4_client, nfs4_put_stid() still reads cl_lock and cl_stateids. Reclaiming the mergeable client_slab object via further SETCLIENTID discloses kernel heap; a UAF is C:H.
- I:HIntegrity impact, high
- nfs4_put_stid() then takes cl_lock and idr_remove()s from cl_stateids on the freed nfs4_client, a slab UAF write concurrent with __destroy_client(). Heap reuse enables arbitrary write and control-flow hijack; a UAF is I:H.
- A:HAvailability impact, high
- Use-after-free of nfs4_client in nfs4_put_stid() (spin_lock of freed cl_lock) oopses or panics the nfsd laundromat worker even without a full exploit, denying service of the NFS server host.