CVE-2026-89660 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize NFSD, particularly those responsible for managing and securing Linux-based infrastructure, including cloud and virtualization environments, should prioritize reviewing and applying patches to prevent potential remote code execution or denial of service due to the use-after-free vulnerability.

Why it matters

The CVE-2026-89660 vulnerability in the Linux kernel's NFSD implementation requires immediate attention from Linux kernel developers, maintainers, and users of Linux-based systems. A use-after-free vulnerability can lead to potential remote code execution or denial of service. To address this, patches from Linux kernel maintainers must be reviewed and applied, and Linux kernel versions must be updated to ensure the fix is applied.

• Potential remote code execution or denial of service due to use-after-free vulnerability.
• Need to verify and apply patches to prevent exploitation.
• Potential impact on Linux-based systems that utilize NFSD, including cloud and virtualization environments.
• Requires review of Linux kernel versions and updates to ensure fix is applied.

Technical summary

The Linux kernel's NFSD implementation has a use-after-free vulnerability during admin state revocation. A stateid holds a bare pointer to its nfs4_client, and a stateid reference does not pin the client. The client survives only because __destroy_client() drains its stateids before free_client() runs. nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(), which dereferences the client to revoke a stateid and read clp->cl_minorversion. A teardown racing the dropped lock can free the client first.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from Linux kernel maintainers to address the use-after-free vulnerability in NFSD.
• Update Linux kernel to a version that includes the fix, such as 6.9 or later.
• Monitor Linux kernel updates and security advisories for potential follow-up patches or mitigations.
• Verify the integrity of affected Linux-based systems that utilize NFSD.
• Conduct a thorough review of system logs to detect potential exploitation attempts.
• Implement compensating controls, such as enhanced monitoring or access restrictions, for exposed systems.
• Inventory and track Linux-based systems that utilize NFSD for remediation prioritization.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to patches. However, the corpus does not establish versions, exploitation, impact, or remediation beyond what is provided in the official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.