vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-90148

NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

N/A
Published: September 17, 2026 at 04:06 PM UTC
Updated: October 21, 2026 at 01:20 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() When nfs4_add_lease() races with a delegation return, it calls nfs4_delete_lease() to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a NULL priv eventually leads to a NULL pointer dereference in generic_setlease().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
5.14e93a5e9306a576011f03011b492d4fbaa274477b
Vendor states this is fixed in 468e458ffde907ba19acd2102ca1fbb8f6fbede2 (fixed)
Vendor states this is fixed in d148a652d52fd6aee96daf798922eb800ebb3018 (fixed)
Vendor states this is fixed in d179ff22cd8514f966966fd9ad425dcbb98e1ada (fixed)
Vendor states this is fixed in ff7244faa13b23e9acfad9df0438f0b44b338f62 (fixed)
Vendor states this is fixed in 5.14 (unaffected)
Vendor states this is fixed in 6.12.110 (unaffected)
Vendor states this is fixed in 6.18.52 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.2.6 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (5)

Source: cverecord
https://git.kernel.org/stable/c/ff7244faa13b23e9acfad9df0438f0b44b338f62
Source: cverecord
https://git.kernel.org/stable/c/d148a652d52fd6aee96daf798922eb800ebb3018
Source: cverecord
https://git.kernel.org/stable/c/d179ff22cd8514f966966fd9ad425dcbb98e1ada
Source: cverecord
https://git.kernel.org/stable/c/468e458ffde907ba19acd2102ca1fbb8f6fbede2
Source: cverecord
https://git.kernel.org/stable/c/e25e5b4a764638ec9e2dc6c9affe080c922ea1f2

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card