Unrated severityNVD Advisory· Published Sep 17, 2026· Updated Oct 30, 2026
CVE-2026-90148
CVE-2026-90148
Description
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
When nfs4_add_lease() races with a delegation return, it calls nfs4_delete_lease() to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a NULL priv eventually leads to a NULL pointer dereference in generic_setlease().
Affected products
3- osv-coords2 versions
>= 5.14.0, < 6.1.191+ 1 more
- (no CPE)range: >= 5.14.0, < 6.1.191
- (no CPE)range: < 7.2.7-1.1
Patches
Vulnerability mechanics
References
6- git.kernel.org/stable/c/468e458ffde907ba19acd2102ca1fbb8f6fbede2nvd
- git.kernel.org/stable/c/c951b876cccd8a4e21fe8b9712894f6a2513ddbcnvd
- git.kernel.org/stable/c/d148a652d52fd6aee96daf798922eb800ebb3018nvd
- git.kernel.org/stable/c/d179ff22cd8514f966966fd9ad425dcbb98e1adanvd
- git.kernel.org/stable/c/e25e5b4a764638ec9e2dc6c9affe080c922ea1f2nvd
- git.kernel.org/stable/c/ff7244faa13b23e9acfad9df0438f0b44b338f62nvd
News mentions
0No linked articles in our index yet.