CVE-2026-89659 Linux CVE debrief

Who should care

Linux administrators and users, as well as developers and security teams responsible for maintaining and securing Linux-based systems, should assess their exposure and apply patches or mitigations as necessary.

Why it matters

This vulnerability in the Linux kernel's NFSD can lead to system instability, potential elevation of privileges, and increased risk of DoS attacks. Linux administrators and users should assess their exposure and apply patches or mitigations as necessary.

• Potential system crashes or instability due to use-after-free errors.
• Possible elevation of privileges or unauthorized access.
• Increased risk of denial-of-service (DoS) attacks.
• Need for verification of affected versions and application of patches.

Technical summary

The Linux kernel's NFSD is vulnerable to a use-after-free issue during delegation revocation. The `nfs4_laundromat` function can cause a client to be freed while a delegation is still being processed, leading to a potential use-after-free error. This has been addressed through a series of commits that pin the client with `cl_rpc_users` across the revoke, ensuring that teardown blocks until it completes, thus preventing the use-after-free error. Linux administrators and users should assess their exposure and apply patches or mitigations as necessary to address this vulnerability.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to ensure the vulnerability is addressed.
• Monitor Linux kernel versions for updates and apply patches as necessary.
• Implement compensating controls to detect and prevent potential exploitation.
• Conduct a thorough review of system configurations and apply necessary changes to prevent exploitation.
• Verify that all necessary patches have been applied and that the system is up-to-date.
• Perform regular security audits to identify potential vulnerabilities.
• Engage with Linux community resources for additional guidance on mitigation and remediation.

Evidence notes

The vulnerability is caused by the `nfs4_laundromat` function unhashing an expired delegation from `cl_delegations`, dropping `deleg_lock`, then `revoke_delegation` relinking it onto `cl_revoked` under `cl_lock`. This creates a window where the delegation is on neither list, causing `client_has_state` to report no remaining state. The issue is resolved by pinning the client with `cl_rpc_users` across the revoke.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.