CVE-2026-90037

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during close_lru reaping

An nfs4openowner left on nn->closelru after its final CLOSE keeps

its last closed stateid in oolastclosed_stid, holding only a raw

pointer to its nfs4_client. The laundromat reaps timed-out entries,

drops nn->clientlock, and calls nfs4put_stid(), which dereferences

the client through cl_lock. Nothing pins the client across that

window, so a concurrent forceexpireclient() can free it and

nfs4putstid() reads freed memory. _destroyclient() hits the same

race, walking clp->clopenowners without cllock.

Pin the client with clrpcusers before dropping client_lock, and

skip clients already expiring. _destroyclient() then cleans up its

own closelru entries through releaselastclosedstateid(), so

teardown no longer races the laundromat.