« Volver al listado

CVE-2026-90151

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: remove callback IDR entry on client allocation failure

nfs4_alloc_client() allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the nfs_client directly with nfs_free_client(). That bypasses nfs_put_client(), which is where the callback IDR entry is removed during normal teardown.

A failed allocation can therefore leave cb_ident_idr pointing at a freed nfs_client. A later NFSv4.0 callback lookup by cb_ident would find the stale pointer and take a reference to it.

Leer descripción completaMostrar menos

Make the callback IDR removal helper callable by the allocation failure path, and remove the callback identifier before freeing the client.

This was found by a local static-analysis checker for publish-before-free lifetime bugs and confirmed by manual inspection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en kernel NFSv4 (AV:N) con fuga de puntero a cliente liberado. Potencial denegación de servicio por referencia a memoria inválida o escalada. Explotación remota de aplicación expuesta (NFSv4).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90151",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
              "lessThan": "68c721391b761dbe38d5b0094d2bb6e8489ad92b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
              "lessThan": "9bfdd0f591307b5198826a0e7a5b2f35f87acd2d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
              "lessThan": "7c4812eb96bdcafb31a65b12f2aa96659429d1d4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
              "lessThan": "fc95ca82d5ae598c428ab5a00ae69f8526d59371",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
              "lessThan": "80b1c3d5a881f7d9081aa9f46da9742878a0f893",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
              "lessThan": "3f2387e8bfbc4efda5d77c3a11a028d0a119c48f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
              "lessThan": "5891c03e150920618db0e9c4ea2d772abacdcfd1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
              "lessThan": "d05c2007b3d84ccba11dc6e9cb3202768cc72f14",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/nfs/client.c",
            "fs/nfs/internal.h",
            "fs/nfs/nfs4client.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.38",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/nfs/client.c",
            "fs/nfs/internal.h",
            "fs/nfs/nfs4client.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:08.057",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3f2387e8bfbc4efda5d77c3a11a028d0a119c48f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5891c03e150920618db0e9c4ea2d772abacdcfd1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/68c721391b761dbe38d5b0094d2bb6e8489ad92b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7c4812eb96bdcafb31a65b12f2aa96659429d1d4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/80b1c3d5a881f7d9081aa9f46da9742878a0f893",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9bfdd0f591307b5198826a0e7a5b2f35f87acd2d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d05c2007b3d84ccba11dc6e9cb3202768cc72f14",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fc95ca82d5ae598c428ab5a00ae69f8526d59371",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: remove callback IDR entry on client allocation failure\n\nnfs4_alloc_client() allocates an NFSv4.0 callback identifier before it\nfinishes setting up the client. If any later initialization step fails,\nthe error path frees the nfs_client directly with nfs_free_client(). That\nbypasses nfs_put_client(), which is where the callback IDR entry is\nremoved during normal teardown.\n\nA failed allocation can therefore leave cb_ident_idr pointing at a freed\nnfs_client. A later NFSv4.0 callback lookup by cb_ident would find the\nstale pointer and take a reference to it.\n\nMake the callback IDR removal helper callable by the allocation failure\npath, and remove the callback identifier before freeing the client.\n\nThis was found by a local static-analysis checker for publish-before-free\nlifetime bugs and confirmed by manual inspection."
    }
  ],
  "lastModified": "2026-09-18T18:17:44.250",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}