CVE-2026-90039: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-90039 is a NULL pointer dereference vulnerability in the Linux kernel's NFSD (NFS server) subsystem that allows a local administrator with CAP_SYS_ADMIN privileges to crash the kernel. The flaw was disclosed on September 16, 2026, and affects Linux kernel versions starting from 6.9. Fixed versions include 6.18.51, 7.2.5, and 7.3-rc1. The CVSS base score is currently listed as 0.0 (unscored/pending), with Feedly estimating a Medium severity (GitHub Advisory, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the NFSD subsystem's admin state-revocation code paths. When writing to /proc/fs/nfsd/unlock_filesystem or issuing NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink commands, the kernel walks NFSv4 client hash tables to revoke open state and cancel async COPY operations. These handlers gate the walk on nn->nfsd_serv being set, but a listener added via portlist or netlink listener_set sets nn->nfsd_serv before any nfsd thread starts — meaning nfsd_startup_net() has not yet allocated nn->conf_id_hashtbl, causing a NULL dereference. The fix gates all three unlock paths on the NFSD_NET_UP flag, which is set only after table allocation in nfsd_startup_net() and cleared after deallocation in nfsd_shutdown_net(), both under nfsd_mutex (GitHub Advisory).

Successful exploitation causes a kernel crash (denial of service), making the affected system unavailable. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Because exploitation requires local access with CAP_SYS_ADMIN, the attack surface is restricted to privileged local administrators or processes with elevated capabilities, limiting the risk of lateral movement or data exfiltration (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with CAP_SYS_ADMIN privileges, significantly limiting the attacker pool.

1. Precondition: Obtain local access to a vulnerable Linux system (kernel 6.9 through pre-fix versions) with CAP_SYS_ADMIN privileges.
2. Trigger NFSD service creation without full startup: Add an NFS listener via portlist or netlink listener_set, which sets nn->nfsd_serv before any nfsd thread starts and before nfsd_startup_net() allocates nn->conf_id_hashtbl.
3. Issue unlock command: Write to /proc/fs/nfsd/unlock_filesystem (e.g., echo 1 > /proc/fs/nfsd/unlock_filesystem) or send an NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command.
4. Kernel crash: The handler walks the NFSv4 client hash tables, dereferences the unallocated (NULL) nn->conf_id_hashtbl, and triggers a kernel NULL pointer dereference, crashing the system (GitHub Advisory).

• Logs: Kernel oops or panic messages referencing NULL pointer dereference in NFSD-related functions (e.g., nfsd4_revoke_states, nfsd_net) in /var/log/kern.log or dmesg output.
• Process: Unexpected writes to /proc/fs/nfsd/unlock_filesystem by non-standard processes or scripts, particularly before the NFS server is fully started.
• System: Sudden kernel crash or reboot on systems with NFS server configured but not yet fully started, especially following netlink command activity related to NFSD.

Upgrade to a patched Linux kernel version: 6.18.51, 7.2.5, or 7.3-rc1 and later, which include the fix gating unlock paths on NFSD_NET_UP (GitHub Advisory). As a workaround, restrict access to /proc/fs/nfsd/unlock_filesystem and limit CAP_SYS_ADMIN capabilities to only fully trusted administrators. Avoid exposing NFSD netlink interfaces to untrusted local users. The relevant fix commits are 104a51265042, 0146467a2fce, and 2f3e6638aebc in the stable kernel tree.