CVE-2026-90151

🗓️ 17 Sep 2026 16:06:44Reported by LinuxType

NFSv4 use-after-free in Linux kernel when client allocation failure leaves stale callback IDR entry.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-90151	18 Sep 202618:20	–	circl
Cvelist	CVE-2026-90151 NFSv4: remove callback IDR entry on client allocation failure	17 Sep 202616:06	–	cvelist
Debian CVE	CVE-2026-90151	17 Sep 202616:06	–	debiancve
EUVD	EUVD-2026-81744	17 Sep 202616:06	–	euvd
NVD	CVE-2026-90151	17 Sep 202617:17	–	nvd
OSV	AZL-102821 CVE-2026-90151 affecting package kernel 6.6.150.1-1	17 Sep 202617:17	–	osv
OSV	BELL-CVE-2026-90151	19 Sep 202606:06	–	osv
OSV	DEBIAN-CVE-2026-90151	17 Sep 202617:17	–	osv
OSV	UBUNTU-CVE-2026-90151	18 Sep 202600:00	–	osv
UbuntuCve	CVE-2026-90151	18 Sep 202600:00	–	ubuntucve

Vulners

CNA

Node

linux linux_kernelRange2.6.38–5.10.270

linux linux_kernelRange5.11.0–5.15.221

linux linux_kernelRange5.16.0–6.1.188

linux linux_kernelRange6.2.0–6.6.157

linux linux_kernelRange6.7.0–6.12.110

linux linux_kernelRange6.13.0–6.18.52

linux linux_kernelRange6.19.0–7.2.6

linux linux_kernelRange7.3.0–7.3-rc1

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "fs/nfs/client.c",
      "fs/nfs/internal.h",
      "fs/nfs/nfs4client.c"
    ],
    "versions": [
      {
        "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
        "lessThan": "68c721391b761dbe38d5b0094d2bb6e8489ad92b",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
        "lessThan": "9bfdd0f591307b5198826a0e7a5b2f35f87acd2d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
        "lessThan": "7c4812eb96bdcafb31a65b12f2aa96659429d1d4",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
        "lessThan": "fc95ca82d5ae598c428ab5a00ae69f8526d59371",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
        "lessThan": "80b1c3d5a881f7d9081aa9f46da9742878a0f893",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
        "lessThan": "3f2387e8bfbc4efda5d77c3a11a028d0a119c48f",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
        "lessThan": "5891c03e150920618db0e9c4ea2d772abacdcfd1",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "f4eecd5da3422e82e88e36c33cbd2595eebcacb1",
        "lessThan": "d05c2007b3d84ccba11dc6e9cb3202768cc72f14",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "fs/nfs/client.c",
      "fs/nfs/internal.h",
      "fs/nfs/nfs4client.c"
    ],
    "versions": [
      {
        "version": "2.6.38",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "2.6.38",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.270",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.221",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.188",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.157",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.110",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.52",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.2.6",
        "lessThanOrEqual": "7.2.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.3-rc1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/fc95ca82d5ae598c428ab5a00ae69f8526d59371
git	www.git.kernel.org/stable/c/68c721391b761dbe38d5b0094d2bb6e8489ad92b
git	www.git.kernel.org/stable/c/5891c03e150920618db0e9c4ea2d772abacdcfd1
git	www.git.kernel.org/stable/c/7c4812eb96bdcafb31a65b12f2aa96659429d1d4
git	www.git.kernel.org/stable/c/9bfdd0f591307b5198826a0e7a5b2f35f87acd2d
git	www.git.kernel.org/stable/c/d05c2007b3d84ccba11dc6e9cb3202768cc72f14
git	www.git.kernel.org/stable/c/80b1c3d5a881f7d9081aa9f46da9742878a0f893
git	www.git.kernel.org/stable/c/3f2387e8bfbc4efda5d77c3a11a028d0a119c48f

18 Sep 2026 18:17Current

CVSS 3.19.8

EPSS0.00739