CVE-2026-90151: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-h72c-5c39-xm46
Share
CVSS 9.8
Published
Advisory Summary

CVE-2026-90151 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90151 at a Glance

CVE Identifier CVE-2026-90151
GHSA Identifier GHSA-h72c-5c39-xm46
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-90151

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90151, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4_alloc_client() allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the nfs_client directly with nfs_free_client(). That bypasses nfs_put_client(), which is where the callback IDR entry is removed during normal teardown. A failed allocation can therefore leave cb_ident_idr pointing at a freed nfs_client. A later NFSv4.0 callback lookup by cb_ident would find the stale pointer and take a reference to it. Make the callback IDR removal helper callable by the allocation failure path, and remove the callback identifier before freeing the client. This was found by a local static-analysis checker for publish-before-free lifetime bugs and confirmed by manual inspection.

References

NVD — CVE-2026-90151 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90151
git.kernel.org/stable/c/3f2387e8bf... WEB
https://git.kernel.org/stable/c/3f2387e8bfbc4efda5d77c3a11a028d0a119c48f
git.kernel.org/stable/c/5891c03e15... WEB
https://git.kernel.org/stable/c/5891c03e150920618db0e9c4ea2d772abacdcfd1
git.kernel.org/stable/c/68c721391b... WEB
https://git.kernel.org/stable/c/68c721391b761dbe38d5b0094d2bb6e8489ad92b
git.kernel.org/stable/c/7c4812eb96... WEB
https://git.kernel.org/stable/c/7c4812eb96bdcafb31a65b12f2aa96659429d1d4
git.kernel.org/stable/c/80b1c3d5a8... WEB
https://git.kernel.org/stable/c/80b1c3d5a881f7d9081aa9f46da9742878a0f893
git.kernel.org/stable/c/9bfdd0f591... WEB
https://git.kernel.org/stable/c/9bfdd0f591307b5198826a0e7a5b2f35f87acd2d
git.kernel.org/stable/c/d05c2007b3... WEB
https://git.kernel.org/stable/c/d05c2007b3d84ccba11dc6e9cb3202768cc72f14
git.kernel.org/stable/c/fc95ca82d5... WEB
https://git.kernel.org/stable/c/fc95ca82d5ae598c428ab5a00ae69f8526d59371

Frequently Asked Questions

What is CVE-2026-90151?
CVE-2026-90151 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90151?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-90151?
CVE-2026-90151 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-90151?
CVE-2026-90151 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90151?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h72c-5c39-xm46",
  "modified" : "2026-09-18T18:31:27Z",
  "published" : "2026-09-17T18:31:52Z",
  "aliases" : [ "CVE-2026-90151" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: remove callback IDR entry on client allocation failure\n\nnfs4_alloc_client() allocates an NFSv4.0 callback identifier before it\nfinishes setting up the client. If any later initialization step fails,\nthe error path frees the nfs_client directly with nfs_free_client(). That\nbypasses nfs_put_client(), which is where the callback IDR entry is\nremoved during normal teardown.\n\nA failed allocation can therefore leave cb_ident_idr pointing at a freed\nnfs_client. A later NFSv4.0 callback lookup by cb_ident would find the\nstale pointer and take a reference to it.\n\nMake the callback IDR removal helper callable by the allocation failure\npath, and remove the callback identifier before freeing the client.\n\nThis was found by a local static-analysis checker for publish-before-free\nlifetime bugs and confirmed by manual inspection.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90151"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3f2387e8bfbc4efda5d77c3a11a028d0a119c48f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5891c03e150920618db0e9c4ea2d772abacdcfd1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/68c721391b761dbe38d5b0094d2bb6e8489ad92b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7c4812eb96bdcafb31a65b12f2aa96659429d1d4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/80b1c3d5a881f7d9081aa9f46da9742878a0f893"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9bfdd0f591307b5198826a0e7a5b2f35f87acd2d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d05c2007b3d84ccba11dc6e9cb3202768cc72f14"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fc95ca82d5ae598c428ab5a00ae69f8526d59371"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:08Z"
  }
}