DEBIAN-CVE-2026-90151

In the Linux kernel, the following vulnerability has been resolved:  NFSv4: remove callback IDR entry on client allocation failure  nfs4allocclient() allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the nfsclient directly with nfsfreeclient(). That bypasses nfsputclient(), which is where the callback IDR entry is removed during normal teardown.  A failed allocation can therefore leave cbidentidr pointing at a freed nfsclient. A later NFSv4.0 callback lookup by cb_ident would find the stale pointer and take a reference to it.  Make the callback IDR removal helper callable by the allocation failure path, and remove the callback identifier before freeing the client.  This was found by a local static-analysis checker for publish-before-free lifetime bugs and confirmed by manual inspection.