CVE-2026-90038

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during export state revocation

nfsd4revokeexport_states() has the same use-after-free as

nfsd4revokestates(): it drops nn->client_lock across

revokeonestid() and the following read of clp->cl_minorversion, but

the stateid reference it holds does not pin the client.  A teardown

racing the dropped lock can free the client while revokeonestid()

still dereferences it.

exportfs -u drives this path through NFSDCMDUNLOCK_EXPORT, so an

administrator removing an export can race a client expiry.

Skip a client that is already expiring and otherwise pin it with

clrpcusers under client_lock before dropping the lock, matching

nfsd4revokestates().