CVE-2026-89658 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize NFSD. These individuals should be aware of the vulnerability and take steps to address it, including reviewing and applying patches, monitoring for potential exploitation attempts, and implementing compensating controls as needed.

Why it matters

A use-after-free vulnerability in the Linux kernel's NFSD implementation requires immediate attention from Linux kernel developers, maintainers, and users. The vulnerability can lead to system crashes or potentially allow code execution if exploited.

• Potential system crashes or code execution due to use-after-free vulnerability
• Need to verify and apply patches to prevent exploitation
• Monitoring for potential exploitation attempts is necessary

Technical summary

The vulnerability exists in the Linux kernel's NFSD implementation, specifically during NFSv4.0 revoked-state cleanup. A use-after-free occurs when the laundromat cleanup and force_expire_client() race, potentially allowing a client to access freed memory. The vulnerability can be addressed by pinning the client with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states(). This fix ensures that the client is not freed while still being used, preventing the use-after-free vulnerability.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor for potential exploitation attempts
• Perform a thorough review of the system to identify any potential vulnerabilities
• Implement compensating controls to mitigate the risk of exploitation
• Conduct regular security audits to detect and address any potential issues
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved

Evidence notes

The vulnerability is caused by a race condition between the laundromat cleanup and force_expire_client(). The laundromat cleanup takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. If the client is being torn down at the same time, it can be freed while nfsd4_drop_revoked_stid() is still using it. The vulnerability can be addressed by pinning the client with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.