Linux Kernel CVE-2026-90151

Requires the host to act as an NFSv4.0 client (mounting NFSv4.0 shares, which involves privileged mount/config operations), AND a failure of a client-initialization step inside nfs4_alloc_client() after the callback identifier is registered - typically an allocation failure under memory pressure, which is not attacker-controlled. Only then can a subsequent NFSv4.0 callback lookup by cb_ident hit the stale freed nfs_client. Exploitation is limited by: non-attacker-controllable trigger (allocation must fail at a precise point), local privilege to establish the NFSv4.0 client, dependence on the NFSv4.0 callback channel being active, and affected-version range only (fixed in the listed stable backports). This is not remotely triggerable against a default configuration despite the input CVSS AV:N.

The input assigns CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), but this rating is badly overstated for the actual defect. This is a publish-before-free lifetime bug (effectively CWE-416 use-after-free): nfs4_alloc_client() registers an NFSv4.0 callback identifier in cb_ident_idr before client setup completes, and the error path uses nfs_free_client() instead of nfs_put_client(), leaving cb_ident_idr pointing at a freed nfs_client that a later callback lookup by cb_ident can dereference and reference. Critically, the bug only manifests when a client-initialization step FAILS (e.g. memory allocation failure under pressure), which is not attacker-controlled and is exactly the kind of condition a network-unauthenticated remote attacker cannot reliably force. The triggering side (setting up an NFSv4.0 client / mounting) is local and privileged, so AV:N/AC:L/PR:N is not credible - this is realistically local, high-complexity, low-privilege at minimum. There is no EPSS score, no CISA KEV listing, and no public exploit; the changelog itself states it was 'found by a local static-analysis checker for publish-before-free lifetime bugs and confirmed by manual inspection,' i.e. a defensive robustness fix with no evidence of practical exploitation. This is a low real-world priority despite the headline 9.8 - patch on normal kernel maintenance cadence, not as an emergency.

On a host that mounts NFSv4.0 shares, an initialization failure during nfs4_alloc_client() (for example under memory pressure) frees the nfs_client while its callback identifier remains registered in cb_ident_idr. A subsequent NFSv4.0 callback arriving from the server is looked up by cb_ident, finds the stale pointer, and takes a reference to freed memory, causing a use-after-free that most likely crashes the kernel (DoS) and could in principle be leveraged for memory corruption. No public exploit exists; this was discovered by static analysis, and reliably triggering the allocation-failure window is impractical for a remote attacker.