{"id":"CVE-2026-90151","published":"2026-09-17T17:17:08.057","lastModified":"2026-09-18T18:17:44.250","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: remove callback IDR entry on client allocation failure\n\nnfs4_alloc_client() allocates an NFSv4.0 callback identifier before it\nfinishes setting up the client. If any later initialization step fails,\nthe error path frees the nfs_client directly with nfs_free_client(). That\nbypasses nfs_put_client(), which is where the callback IDR entry is\nremoved during normal teardown.\n\nA failed allocation can therefore leave cb_ident_idr pointing at a freed\nnfs_client. A later NFSv4.0 callback lookup by cb_ident would find the\nstale pointer and take a reference to it.\n\nMake the callback IDR removal helper callable by the allocation failure\npath, and remove the callback identifier before freeing the client.\n\nThis was found by a local static-analysis checker for publish-before-free\nlifetime bugs and confirmed by manual inspection.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/3f2387e8bfbc4efda5d77c3a11a028d0a119c48f","tags":[]},{"url":"https://git.kernel.org/stable/c/5891c03e150920618db0e9c4ea2d772abacdcfd1","tags":[]},{"url":"https://git.kernel.org/stable/c/68c721391b761dbe38d5b0094d2bb6e8489ad92b","tags":[]},{"url":"https://git.kernel.org/stable/c/7c4812eb96bdcafb31a65b12f2aa96659429d1d4","tags":[]},{"url":"https://git.kernel.org/stable/c/80b1c3d5a881f7d9081aa9f46da9742878a0f893","tags":[]},{"url":"https://git.kernel.org/stable/c/9bfdd0f591307b5198826a0e7a5b2f35f87acd2d","tags":[]},{"url":"https://git.kernel.org/stable/c/d05c2007b3d84ccba11dc6e9cb3202768cc72f14","tags":[]},{"url":"https://git.kernel.org/stable/c/fc95ca82d5ae598c428ab5a00ae69f8526d59371","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows a callback IDR entry to remain after client allocation failure, leading to a stale pointer that can be exploited by an attacker to take a reference to a freed client structure.","exploitability":"Exploitation is moderately difficult as it requires a specific failure condition during client allocation, but once triggered, the vulnerability can be exploited with minimal effort.","blast_radius":"If exploited, the vulnerability could lead to unauthorized access or control over the affected system, potentially allowing an attacker to perform operations as the compromised client.","remediation":"Upgrade to the Linux kernel version 6.2.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","kernel","nfs","vulnerability"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-27T09:02:49.684Z"}}