DEBIAN-CVE-2026-90037

In the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent client use-after-free during closelru reaping  An nfs4openowner left on nn->closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundromat reaps timed-out entries, drops nn->clientlock, and calls nfs4putstid(), which dereferences the client through cllock. Nothing pins the client across that window, so a concurrent forceexpireclient() can free it and nfs4putstid() reads freed memory. destroyclient() hits the same race, walking clp->clopenowners without cllock.  Pin the client with clrpcusers before dropping clientlock, and skip clients already expiring. destroyclient() then cleans up its own closelru entries through releaselastclosedstateid(), so teardown no longer races the laundromat.