Threats tagged 'ghsa-cj69-89jw-ggxp'

CVE-2026-90037 is a critical use-after-free vulnerability in the Linux kernel's NFSD component related to client handling during close_lru reaping. The flaw arises when an nfs4_openowner remains on the close_lru list after its final CLOSE, holding a raw pointer to an nfs4_client that can be freed concurrently, leading to dereferencing freed memory. This race condition can cause memory corruption and potentially allow for denial of service or other impacts. The issue has been resolved by properly pinning the client before dropping locks and ensuring safe cleanup without racing conditions.