EUVD-2026-80645
GHSA-cj69-89jw-ggxp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NFSD is network-facing (AV:N) but reaching close_lru needs an authorized NFSv4 client (PR:L) and a narrow reaping-vs-expire race (AC:H); the freed-memory read is internal, so impact is a crash only (C:N/I:N/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during close_lru reaping
An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid in oo_last_closed_stid, holding only a raw pointer to its nfs4_client. The laundromat reaps timed-out entries, drops nn->client_lock, and calls nfs4_put_stid(), which dereferences the client through cl_lock. Nothing pins the client across that window, so a concurrent force_expire_client() can free it and nfs4_put_stid() reads freed memory. __destroy_client() hits the same race, walking clp->cl_openowners without cl_lock.
Pin the client with cl_rpc_users before dropping client_lock, and skip clients already expiring. __destroy_client() then cleans up its own close_lru entries through release_last_closed_stateid(), so teardown no longer races the laundromat.
AnalysisAI
Use-after-free in the Linux kernel's NFSv4 server (NFSD) lets an NFSv4 client that already holds authorized state on an exported filesystem trigger a kernel memory-corruption denial of service by racing the close_lru laundromat against a concurrent client expiry. Only hosts actively exporting NFSv4 filesystems are exposed, the attacker must be an authenticated client able to open and CLOSE files so that an nfs4_openowner is left on nn->close_lru, and the required timing window is narrow, so real-world impact is availability loss (kernel oops/crash) rather than code execution - no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The host must run the Linux kernel NFS server (NFSD) and actively export at least one NFSv4 filesystem; the attacker must be an NFSv4 client able to open and CLOSE files so an nfs4_openowner with oo_last_closed_stid is left on nn->close_lru. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which is wildly over-scored for what the description actually reports: a CWE-416/362 use-after-free race in the Linux NFSD server, where the laundromat reaps a timed-out nfs4_openowner from nn->close_lru, drops nn->client_lock, and calls nfs4_put_stid() which dereferences a raw pointer to the nfs4_client through cl_lock while a concurrent force_expire_client() (or __destroy_client() walking cl_openowners) can free that client. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading to Linux 6.18.51, 7.2.5 or 7.3-rc1 (or any later stable/mainline release containing the fixes), or backport the upstream commits 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3, e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1 and 2330b788d732f43668b965b3105b37ceb276dfea from git.kernel.org; see also https://nvd.nist.gov/vuln/detail/CVE-2026-90037. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Linux host running NFSD with active NFSv4 exports (check /proc/fs/nfsd and export configuration) and confirm whether kernel versions prior to 6.18.51 or 7.2.5 are in use; where patching cannot be immediate, reduce exposure by restricting NFS exports to trusted client subnets and disabling NFSv4 export service on hosts that do not require it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today