* [CVE-2026-90037][MODERATE 7.0] NFSD: Prevent client use-after-free during close_lru reaping [ Upstream
@ 2026-09-16 12:21 21% AL-KERNEL
0 siblings, 0 replies; 1+ results
From: AL-KERNEL @ 2026-09-16 12:21 UTC (permalink / raw)
To: kernel-cve
CVE: CVE-2026-90037
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: NFSD: Prevent client use-after-free during close_lru reaping [ Upstream
Commit: 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=83dd59ac1c3455c2c7d8ddb582d980a13199b9b3
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90037
Analysis date: Wed, 16 Sep 2026 08:21:55 -0400
ActionableScore: 6
ActionableScore lower bound: 4
Actionable bucket: Actionable Moderate / Strong Important candidate requiring manual review
Manual review required: YES
Summary:
No one-sentence report phrase was found.
======================================================================
ABOUT THIS REPORT
======================================================================
The original Linux kernel CVE announcement for CVE-2026-90037 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90037
The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.
The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.
Published priority for this report: MODERATE 7.0
Manual review required: YES
A detailed explanation of the methodology and priority rules is included
at the end of this message.
======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================
CVE-2026-90037 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-90037 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H';*CWE-416;CWE-362;CWE-667;Other CVSS 'AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7.5';DESCR 'A use-after-free can occur in the NFSD NFSv4 state handling path when an nfs4_openowner remains on close_lru after the final CLOSE and keeps oo_last_closed_stid with only a raw pointer to its nfs4_client. During close_lru reaping, nfs4_laundromat can drop client_lock and call nfs4_put_stid(), while a concurrent client expiration path can free the same nfs4_client and make later cl_lock access read freed memory. For the CVSS the PR:L is used because a remote NFSv4 client normally needs access to the exported NFS service or valid client state, but full local administrative privileges on the server are not required. The issue is network reachable when NFSD NFSv4 is exposed to the attacker, although NFS servers are commonly limited to trusted internal or storage networks. Impact is at least denial of service via kernel crash. In the paranoid interpretation, this is a kernel use-after-free race and may allow broader confidentiality or integrity impact, so it should be reviewed manually.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate / Strong Important candidate requiring manual review (with actual score 5) YES DANGER DISK RACE UAF NETWORK LINUS KPANIC KPANIC INCREASED_TO_MODERATE7_BASED_ON_GUESSCVSS NO NO checked
======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================
ActionableScore=6
ActionableScoreLower=4
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=NO
NamespaceScopedPrivilege=NO
ImportantCandidate=YES
ManualReview=REQUIRED
AutoDowngradeAllowed=NO
1. ActionableScore
* Raw conservative score: 4
* Conservative score: 4
* Raw paranoid score: 6
* Paranoid score: 6
* Final recommended bucket: **Actionable Moderate / Strong Important candidate requiring manual review**::
No floor or cap changed the conservative score. No floor or cap changed the paranoid score.
2. Signal breakdown
Conservative signals:
* +2 Real UAF / lifetime violation: `nfs4_openowner` can retain `oo_last_closed_stid` with a raw `nfs4_client` pointer, while concurrent client expiration can free that client before `nfs4_put_stid()` dereferences it through `cl_lock`.
* +2 Remote reachable / network service path: the affected code is in NFSD NFSv4 state handling and can be reached by an NFSv4 client when the NFS service is exposed and the client can create valid protocol state.
* +1 Reliable kernel crash / strong DoS: use of freed `nfs4_client` memory in kernel state cleanup can realistically cause Oops, panic, or fatal kernel fault.
* -1 Hard timing / race window: the demonstrated bug requires an interleaving between close_lru reaping, dropping `client_lock`, and concurrent client expiration.
Paranoid additional signal:
* +1 Attacker-influenced repeatable lifetime manipulation: an NFSv4 client can influence creation of client/openowner/stateid state and final CLOSE behavior, and repeated client state creation and expiration attempts can make the lifetime race more than a purely one-shot internal event.
Important non-awarded signals:
* Controlled reclaim is not demonstrated.
* Arbitrary kernel read/write is not demonstrated.
* Callback or function-pointer control is not demonstrated.
* Concrete repeated release/refcount mutation on the exact same dangling `nfs4_client` reference is not established.
* Structured stale-object leverage is not separately awarded because the visible stale operation is the same UAF dereference path through client state, without proven attacker-shaped replacement contents.
* Weak LPE is not separately awarded because there is no additional primitive beyond the UAF and unresolved lifetime race.
* Extra availability is not awarded because the same kernel crash is already counted once.
* Confidentiality and integrity impact are not awarded as direct score signals because no disclosure path, arbitrary write, or controlled object replacement is established.
Repeated-release/refcount checklist:
* First release can end lifetime: yes, concurrent `force_expire_client()` can free the `nfs4_client`.
* Exact same reference survives: yes, the raw client pointer remains reachable through the openowner/stateid relationship.
* Second operation is a real lifetime/refcount mutation on the same client: no, the visible second operation is a stale dereference/use through `nfs4_put_stid()` and `cl_lock`, not a proven second `put` or refcount decrement on the exact same client.
* +1 Concrete repeated release/refcount awarded: no.
* Paranoid repeated-refcount leverage +1 awarded: no.
* FLOOR 5 applied due to repeated release/refcount: no.
3. Reachability analysis
The likely attacker is a remote NFSv4 client with access to the affected NFSD service. The client can create NFSv4 openowner and stateid state and can perform final CLOSE operations that leave entries for close_lru processing. Full host administrative privilege on the server is not required for the protocol-level portion of the trigger, so `HostAdminRequired=NO`.
The issue is not namespace-scoped in the relevant sense. No supplied evidence shows that a user/network namespace capability is the governing privilege boundary for the complete trigger, so `NamespaceScopedPrivilege=NO`.
A prior server-side setup exists in the practical deployment sense: NFSD and NFSv4 exports must be configured and reachable. This is a service exposure condition, not a host-admin requirement for the attacker once the service is available. No special hardware is involved.
The race requires concurrent close_lru reaping and client expiration. The exact interleaving is timing-sensitive, but the involved objects are protocol state objects that can plausibly be recreated repeatedly by a client with NFSv4 access.
4. Primitive and severity interpretation
The exact primitive is a real kernel use-after-free of `struct nfs4_client` state. The stale object is an active structured NFSD client object, not fixed stale storage. The stale path occurs during cleanup/reaping, but it is not merely passive metadata because the stale client is dereferenced through state-management code and `cl_lock`.
This is `PrimitiveClass=CLASS_B`: a real lifetime/corruption primitive exists, but controlled reclaim, arbitrary write, callback control, or demonstrated privilege escalation is not established.
Demonstrated consequence is at least denial of service through kernel crash or fatal fault. Speculative consequence is broader exploitation from a network-reachable kernel UAF, but the supplied evidence does not prove a working C/I primitive.
`ImportantCandidate=YES` because this is a network-reachable active-object UAF in NFSD with unresolved exploitation leverage beyond a simple NULL dereference. `AutoDowngradeAllowed=NO` because automatically closing it as ordinary Moderate would discard a concrete kernel lifetime bug in a server path that needs manual Important-vs-Moderate review.
Likely operational severity: Actionable Moderate at minimum, with Strong Important candidacy requiring manual review.
5. One-sentence report phrase
A network-reachable NFSD NFSv4 use-after-free can occur when close_lru reaping drops client_lock before nfs4_put_stid() while concurrent client expiration frees the referenced nfs4_client, causing at least kernel crash DoS and requiring manual review for possible stronger exploitation.
6. Manual review recommendation
MANUAL CHECK REQUIRED
Reason: real active-object UAF in a remotely reachable NFSD NFSv4 server path, with unresolved post-lifetime exploitation potential even though controlled reclaim or LPE is not demonstrated.
7. Call-site confidence
Call-site confidence: high
======================================================================
UPSTREAM PATCH SUMMARY
======================================================================
Patch: NFSD: Prevent client use-after-free during close_lru reaping [ Upstream
Commit: 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=83dd59ac1c3455c2c7d8ddb582d980a13199b9b3
Changed files:
fs/nfsd/nfs4state.c
Diff excerpt:
Not included in this email. See the upstream URL for the full patch.
Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=83dd59ac1c3455c2c7d8ddb582d980a13199b9b3
======================================================================
DETAILED REPORT METHODOLOGY
======================================================================
The original Linux kernel CVE announcement for CVE-2026-90037 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90037
The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.
The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.
The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.
Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:
Conservative CVSS vector: AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
The Best / paranoid CVSS vector: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The Best / paranoid CVSS score: 7.5
The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.
CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.
A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.
Conservative ActionableScore: 4
Paranoid ActionableScore: 6
The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.
For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:
ActionableScore below 5 -> MODERATE REGULAR
ActionableScore 5 or more -> MODERATE 7.0
The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.
There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).
KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.
AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0
These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).
Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is [email protected] (and both
send reply to CVE record itself too and see "reply" button below for howto reply).
^ permalink raw reply [relevance 21%]
Results 1-1 of 1 | reverse | sort options + mbox downloads above
-- links below jump to the message on this page --
2026-09-16 12:21 21% [CVE-2026-90037][MODERATE 7.0] NFSD: Prevent client use-after-free during close_lru reaping [ Upstream AL-KERNEL
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox