FKIE_CVE-2026-90148

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() When nfs4_add_lease() races with a delegation return, it calls nfs4_delete_lease() to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a NULL priv eventually leads to a NULL pointer dereference in generic_setlease().
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/468e458ffde907ba19acd2102ca1fbb8f6fbede2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d148a652d52fd6aee96daf798922eb800ebb3018
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d179ff22cd8514f966966fd9ad425dcbb98e1ada
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ff7244faa13b23e9acfad9df0438f0b44b338f62
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff7244faa13b23e9acfad9df0438f0b44b338f62",
              "status": "affected",
              "version": "e93a5e9306a576011f03011b492d4fbaa274477b",
              "versionType": "git"
            },
            {
              "lessThan": "d148a652d52fd6aee96daf798922eb800ebb3018",
              "status": "affected",
              "version": "e93a5e9306a576011f03011b492d4fbaa274477b",
              "versionType": "git"
            },
            {
              "lessThan": "d179ff22cd8514f966966fd9ad425dcbb98e1ada",
              "status": "affected",
              "version": "e93a5e9306a576011f03011b492d4fbaa274477b",
              "versionType": "git"
            },
            {
              "lessThan": "468e458ffde907ba19acd2102ca1fbb8f6fbede2",
              "status": "affected",
              "version": "e93a5e9306a576011f03011b492d4fbaa274477b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()\n\nWhen nfs4_add_lease() races with a delegation return, it calls\nnfs4_delete_lease() to clean up. Previously, it passed priv,\nwhich can legitimately be NULL. Passing a NULL priv eventually\nleads to a NULL pointer dereference in generic_setlease()."
    }
  ],
  "id": "CVE-2026-90148",
  "lastModified": "2026-09-17T17:17:07.710",
  "metrics": {},
  "published": "2026-09-17T17:17:07.710",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/468e458ffde907ba19acd2102ca1fbb8f6fbede2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d148a652d52fd6aee96daf798922eb800ebb3018"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d179ff22cd8514f966966fd9ad425dcbb98e1ada"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ff7244faa13b23e9acfad9df0438f0b44b338f62"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.