CVE-2026-89709

Received Received - Intake

Use-After-Free in Linux Kernel NFS Locking

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89709

EUVD

EUVD-2026-76621

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a use-after-free issue in the Linux kernel's lockd and nfsd components. The nlmsvc_ops pointer is published without proper RCU protection, leading to potential NULL dereferences or module-text use-after-free when nfsd is unloaded after lockd accesses it.

Detection Guidance

This vulnerability is specific to the Linux kernel's lockd and nfsd components and involves a use-after-free scenario. Detection requires checking kernel logs for crashes or errors related to nfsd or lockd, such as NULL pointer dereferences or module unloading issues. Commands like dmesg, journalctl -k, or checking /var/log/kern.log may reveal relevant errors. No direct network detection commands are applicable as this is a local kernel issue.

Impact Analysis

This could cause system crashes, data corruption, or privilege escalation if exploited. Systems using NFS (Network File System) with lockd and nfsd modules are at risk, potentially leading to denial of service or unauthorized access.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel memory safety issue in the NFS and lockd subsystems. Compliance impacts would depend on system-specific configurations and data processing activities rather than this technical flaw.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Since the vulnerability is resolved in the kernel, applying the latest stable kernel update is critical. Avoid unloading the nfsd module while services are running to prevent the stale pointer dereference. Monitor kernel logs for any signs of the issue post-update.

Hi! I’m here to help you understand CVE-2026-89709. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70