CVE-2026-90236

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Release the export reference when reaping open stateids

nfs4_put_stid() releases the svc_export tracked in

nfs4_stid.sc_export, but free_ol_stateid_reaplist() frees open and

lock stateids by calling ->sc_free() directly, bypassing that path.

An open stateid takes an sc_export reference in nfs4_open() and a

lock stateid takes its own in init_lock_stateid(); both reach

free_ol_stateid_reaplist() through their normal teardown, the open

stateid via release_open_stateid() and the lock stateid via

nfsd4_release_lockowner(), each through put_ol_stateid_locked().

The reference is therefore never dropped, pinning the export and

blocking unmount for the lifetime of the stateid.

Release sc_export in free_ol_stateid_reaplist() the way

nfs4_put_stid() does. ->sc_free() runs once per stateid, and a

stateid reaches free_ol_stateid_reaplist() or nfs4_put_stid() but

never both, so the reference is dropped exactly once. Revoked

stateids reach this path with sc_export already cleared by

drop_stid_export(), so they are skipped rather than double-freed.

nfs4_put_stid() itself read sc_export before acquiring cl_lock.

drop_stid_export() clears that field and releases the reference

under cl_lock, so a concurrent revocation could drop the export in

the window between the read and the final put, releasing the same

reference twice. Read sc_export while cl_lock is held so the two

paths serialize and the reference is released exactly once.