From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-90037][MODERATE 7.0] NFSD: Prevent client use-after-free during close_lru reaping [ Upstream Date: Wed, 16 Sep 2026 08:21:55 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-90037 X-AL-KERNEL-Priority: MODERATE 7.0 X-AL-KERNEL-Severity: MODERATE 7.0 X-AL-KERNEL-Base-Severity: MODERATE X-AL-KERNEL-KPANIC: YES X-AL-KERNEL-ActionableScore: 6 X-AL-KERNEL-ActionableScore-Lower: 4 X-AL-KERNEL-Commit: 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3 List-Id: CVE: CVE-2026-90037 Priority: MODERATE 7.0 AL-KERNEL base severity: MODERATE KPANIC flag: YES Patch: NFSD: Prevent client use-after-free during close_lru reaping [ Upstream Commit: 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=83dd59ac1c3455c2c7d8ddb582d980a13199b9b3 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90037 Analysis date: Wed, 16 Sep 2026 08:21:55 -0400 ActionableScore: 6 ActionableScore lower bound: 4 Actionable bucket: Actionable Moderate / Strong Important candidate requiring manual review Manual review required: YES Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-90037 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90037 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: MODERATE 7.0 Manual review required: YES A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-90037 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-90037 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H';*CWE-416;CWE-362;CWE-667;Other CVSS 'AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7.5';DESCR 'A use-after-free can occur in the NFSD NFSv4 state handling path when an nfs4_openowner remains on close_lru after the final CLOSE and keeps oo_last_closed_stid with only a raw pointer to its nfs4_client. During close_lru reaping, nfs4_laundromat can drop client_lock and call nfs4_put_stid(), while a concurrent client expiration path can free the same nfs4_client and make later cl_lock access read freed memory. For the CVSS the PR:L is used because a remote NFSv4 client normally needs access to the exported NFS service or valid client state, but full local administrative privileges on the server are not required. The issue is network reachable when NFSD NFSv4 is exposed to the attacker, although NFS servers are commonly limited to trusted internal or storage networks. Impact is at least denial of service via kernel crash. In the paranoid interpretation, this is a kernel use-after-free race and may allow broader confidentiality or integrity impact, so it should be reviewed manually.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate / Strong Important candidate requiring manual review (with actual score 5) YES DANGER DISK RACE UAF NETWORK LINUS KPANIC KPANIC INCREASED_TO_MODERATE7_BASED_ON_GUESSCVSS NO NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=6 ActionableScoreLower=4 PrimitiveClass=CLASS_B RealUAF=YES HostAdminRequired=NO NamespaceScopedPrivilege=NO ImportantCandidate=YES ManualReview=REQUIRED AutoDowngradeAllowed=NO 1. ActionableScore * Raw conservative score: 4 * Conservative score: 4 * Raw paranoid score: 6 * Paranoid score: 6 * Final recommended bucket: **Actionable Moderate / Strong Important candidate requiring manual review**:: No floor or cap changed the conservative score. No floor or cap changed the paranoid score. 2. Signal breakdown Conservative signals: * +2 Real UAF / lifetime violation: `nfs4_openowner` can retain `oo_last_closed_stid` with a raw `nfs4_client` pointer, while concurrent client expiration can free that client before `nfs4_put_stid()` dereferences it through `cl_lock`. * +2 Remote reachable / network service path: the affected code is in NFSD NFSv4 state handling and can be reached by an NFSv4 client when the NFS service is exposed and the client can create valid protocol state. * +1 Reliable kernel crash / strong DoS: use of freed `nfs4_client` memory in kernel state cleanup can realistically cause Oops, panic, or fatal kernel fault. * -1 Hard timing / race window: the demonstrated bug requires an interleaving between close_lru reaping, dropping `client_lock`, and concurrent client expiration. Paranoid additional signal: * +1 Attacker-influenced repeatable lifetime manipulation: an NFSv4 client can influence creation of client/openowner/stateid state and final CLOSE behavior, and repeated client state creation and expiration attempts can make the lifetime race more than a purely one-shot internal event. Important non-awarded signals: * Controlled reclaim is not demonstrated. * Arbitrary kernel read/write is not demonstrated. * Callback or function-pointer control is not demonstrated. * Concrete repeated release/refcount mutation on the exact same dangling `nfs4_client` reference is not established. * Structured stale-object leverage is not separately awarded because the visible stale operation is the same UAF dereference path through client state, without proven attacker-shaped replacement contents. * Weak LPE is not separately awarded because there is no additional primitive beyond the UAF and unresolved lifetime race. * Extra availability is not awarded because the same kernel crash is already counted once. * Confidentiality and integrity impact are not awarded as direct score signals because no disclosure path, arbitrary write, or controlled object replacement is established. Repeated-release/refcount checklist: * First release can end lifetime: yes, concurrent `force_expire_client()` can free the `nfs4_client`. * Exact same reference survives: yes, the raw client pointer remains reachable through the openowner/stateid relationship. * Second operation is a real lifetime/refcount mutation on the same client: no, the visible second operation is a stale dereference/use through `nfs4_put_stid()` and `cl_lock`, not a proven second `put` or refcount decrement on the exact same client. * +1 Concrete repeated release/refcount awarded: no. * Paranoid repeated-refcount leverage +1 awarded: no. * FLOOR 5 applied due to repeated release/refcount: no. 3. Reachability analysis The likely attacker is a remote NFSv4 client with access to the affected NFSD service. The client can create NFSv4 openowner and stateid state and can perform final CLOSE operations that leave entries for close_lru processing. Full host administrative privilege on the server is not required for the protocol-level portion of the trigger, so `HostAdminRequired=NO`. The issue is not namespace-scoped in the relevant sense. No supplied evidence shows that a user/network namespace capability is the governing privilege boundary for the complete trigger, so `NamespaceScopedPrivilege=NO`. A prior server-side setup exists in the practical deployment sense: NFSD and NFSv4 exports must be configured and reachable. This is a service exposure condition, not a host-admin requirement for the attacker once the service is available. No special hardware is involved. The race requires concurrent close_lru reaping and client expiration. The exact interleaving is timing-sensitive, but the involved objects are protocol state objects that can plausibly be recreated repeatedly by a client with NFSv4 access. 4. Primitive and severity interpretation The exact primitive is a real kernel use-after-free of `struct nfs4_client` state. The stale object is an active structured NFSD client object, not fixed stale storage. The stale path occurs during cleanup/reaping, but it is not merely passive metadata because the stale client is dereferenced through state-management code and `cl_lock`. This is `PrimitiveClass=CLASS_B`: a real lifetime/corruption primitive exists, but controlled reclaim, arbitrary write, callback control, or demonstrated privilege escalation is not established. Demonstrated consequence is at least denial of service through kernel crash or fatal fault. Speculative consequence is broader exploitation from a network-reachable kernel UAF, but the supplied evidence does not prove a working C/I primitive. `ImportantCandidate=YES` because this is a network-reachable active-object UAF in NFSD with unresolved exploitation leverage beyond a simple NULL dereference. `AutoDowngradeAllowed=NO` because automatically closing it as ordinary Moderate would discard a concrete kernel lifetime bug in a server path that needs manual Important-vs-Moderate review. Likely operational severity: Actionable Moderate at minimum, with Strong Important candidacy requiring manual review. 5. One-sentence report phrase A network-reachable NFSD NFSv4 use-after-free can occur when close_lru reaping drops client_lock before nfs4_put_stid() while concurrent client expiration frees the referenced nfs4_client, causing at least kernel crash DoS and requiring manual review for possible stronger exploitation. 6. Manual review recommendation MANUAL CHECK REQUIRED Reason: real active-object UAF in a remotely reachable NFSD NFSv4 server path, with unresolved post-lifetime exploitation potential even though controlled reclaim or LPE is not demonstrated. 7. Call-site confidence Call-site confidence: high ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: NFSD: Prevent client use-after-free during close_lru reaping [ Upstream Commit: 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=83dd59ac1c3455c2c7d8ddb582d980a13199b9b3 Changed files: fs/nfsd/nfs4state.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=83dd59ac1c3455c2c7d8ddb582d980a13199b9b3 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-90037 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90037 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS vector: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H The Best / paranoid CVSS score: 7.5 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: 4 Paranoid ActionableScore: 6 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: MODERATE KPANIC detected for this report: YES Published priority for this report (same as in Subject): MODERATE 7.0 These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).