CVE-2026-90148

NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

When nfs4_add_lease() races with a delegation return, it calls nfs4_delete_lease() to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a NULL priv eventually leads to a NULL pointer dereference in generic_setlease().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e93a5e9306a576011f03011b492d4fbaa274477b to before c951b876cccd8a4e21fe8b9712894f6a2513ddbcAffected e93a5e9306a576011f03011b492d4fbaa274477b to before e25e5b4a764638ec9e2dc6c9affe080c922ea1f2Affected e93a5e9306a576011f03011b492d4fbaa274477b to before ff7244faa13b23e9acfad9df0438f0b44b338f62Affected e93a5e9306a576011f03011b492d4fbaa274477b to before d148a652d52fd6aee96daf798922eb800ebb3018Affected e93a5e9306a576011f03011b492d4fbaa274477b to before d179ff22cd8514f966966fd9ad425dcbb98e1adaAffected e93a5e9306a576011f03011b492d4fbaa274477b to before 468e458ffde907ba19acd2102ca1fbb8f6fbede2Affected
LinuxLinux	5.14Affected before 5.14Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e93a5e9306a576011f03011b492d4fbaa274477b to before c951b876cccd8a4e21fe8b9712894f6a2513ddbcAffected
e93a5e9306a576011f03011b492d4fbaa274477b to before e25e5b4a764638ec9e2dc6c9affe080c922ea1f2Affected
e93a5e9306a576011f03011b492d4fbaa274477b to before ff7244faa13b23e9acfad9df0438f0b44b338f62Affected
e93a5e9306a576011f03011b492d4fbaa274477b to before d148a652d52fd6aee96daf798922eb800ebb3018Affected
e93a5e9306a576011f03011b492d4fbaa274477b to before d179ff22cd8514f966966fd9ad425dcbb98e1adaAffected
e93a5e9306a576011f03011b492d4fbaa274477b to before 468e458ffde907ba19acd2102ca1fbb8f6fbede2Affected

LinuxLinux

5.14Affected
before 5.14Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.