CVE-2026-89668

Received Received - Intake

Use-After-Free in Linux Kernel NFS Daemon

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() nfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd(). If the slab allocation fails, the bare "return retval" bypasses nfsd_debugfs_exit(), leaving orphan debugfs files with stale fops pointers into the freed module text. Move nfsd_debugfs_init() to after the slab init succeeds, so the early return has no debugfs state to clean up. Since debugfs is now the more recently initialized of the two, also update the unwind paths to match reverse-initialization (LIFO) order: run nfsd_debugfs_exit() before nfsd4_free_slabs() in both the init_nfsd() error path and exit_nfsd(). The nfsd debugfs files only reference module-global state and have no dependency on the slab caches, so that reordering is a cleanup with no functional change.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89668

EUVD

EUVD-2026-76580

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper initialization order in the NFS server (nfsd) code. The debugfs initialization function runs before slab memory allocation, so if slab allocation fails, the system exits without cleaning up debugfs files. These files retain stale function pointers to freed memory, potentially causing crashes or undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation and does not have a direct network detection method. Check kernel logs for slab allocation failures or debugfs-related errors during NFS server initialization. Commands like dmesg | grep -i nfsd or journalctl -u nfs-server may help identify issues.

Impact Analysis

If exploited, this could lead to system instability, crashes, or privilege escalation on affected Linux systems running NFS services. Users relying on NFS for file sharing may experience service disruptions or security breaches.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a memory management issue in the Linux kernel's NFS daemon (nfsd) where debugfs files may be left orphaned if slab allocation fails. There is no indication this impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-89668. If immediate patching is not possible, consider disabling the NFS server service until the update is applied to prevent potential debugfs corruption.

Hi! I’m here to help you understand CVE-2026-89668. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70