{"id":"CVE-2026-90236","revision":"e596f5a7e43a4acb8e5f4c807394c3b6","records":[{"revision":"e596f5a7e43a4acb8e5f4c807394c3b6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90236","aliases":[],"title":"NFSD: Release the export reference when reaping open stateids","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Release the export reference when reaping open stateids\n\nnfs4_put_stid() releases the svc_export tracked in\nnfs4_stid.sc_export, but free_ol_stateid_reaplist() frees open and\nlock stateids by calling ->sc_free() directly, bypassing that path.\nAn open stateid takes an sc_export reference in nfs4_open() and a\nlock stateid takes its own in init_lock_stateid(); both reach\nfree_ol_stateid_reaplist() through their normal teardown, the open\nstateid via release_open_stateid() and the lock stateid via\nnfsd4_release_lockowner(), each through put_ol_stateid_locked().\nThe reference is therefore never dropped, pinning the export and\nblocking unmount for the lifetime of the stateid.\n\nRelease sc_export in free_ol_stateid_reaplist() the way\nnfs4_put_stid() does. ->sc_free() runs once per stateid, and a\nstateid reaches free_ol_stateid_reaplist() or nfs4_put_stid() but\nnever both, so the reference is dropped exactly once. Revoked\nstateids reach this path with sc_export already cleared by\ndrop_stid_export(), so they are skipped rather than double-freed.\n\nnfs4_put_stid() itself read sc_export before acquiring cl_lock.\ndrop_stid_export() clears that field and releases the reference\nunder cl_lock, so a concurrent revocation could drop the export in\nthe window between the read and the final put, releasing the same\nreference twice. Read sc_export while cl_lock is held so the two\npaths serialize and the reference is released exactly once.","state":0,"publishedAt":"2026-09-17T16:07:41.898+00:00","modifiedAt":"2026-10-19T09:00:12.535+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfsd/nfs4state.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ba0cde5dc81d214684b8ea0bd87414ba2f48fe02\",\n                            \"lessThan\": \"7458727fd7cb79d09e5120b6fecc1ad11cdb0946\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ba0cde5dc81d214684b8ea0bd87414ba2f48fe02\",\n                            \"lessThan\": \"6480bd703684ed3f760e9e36c4a699033c0806ae\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfsd/nfs4state.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/7458727fd7cb79d09e5120b6fecc1ad11cdb0946","https://git.kernel.org/stable/c/6480bd703684ed3f760e9e36c4a699033c0806ae"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90236","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90236","identifiers":["CVE-2026-90236"]},"retained":false,"historicalAffected":[]}],"coverage":[]}