CVE-2026-89667 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers working with the Linux kernel should be aware of this vulnerability and take necessary actions to verify and apply the fix. They should prioritize verifying the presence of the fix in their kernel versions and reviewing system logs for potential exploitation attempts due to a memory leak vulnerability in the Linux kernel's nfsd filecache.

Why it matters

Linux system administrators and security teams should prioritize verifying the presence of the fix in their kernel versions and reviewing system logs for potential exploitation attempts due to a memory leak vulnerability in the Linux kernel's nfsd filecache.

• Memory leak due to unhashed files on per-net dispose list
• Potential for file descriptor exhaustion if not properly drained
• Need for kernel version verification and patch application
• Monitoring system logs for exploitation attempts

Technical summary

The Linux kernel's nfsd filecache had a vulnerability where a race condition between the shrinker, GC worker, and fsnotify/lease callbacks could lead to a file being queued on the per-net dispose list without proper drainage, resulting in a memory leak. The fix involves widening the nfsd_gc_lock and adding synchronization to prevent this issue. The vulnerability was addressed by 1. Widening nfsd_gc_lock in both nfsd_file_gc() and nfsd_file_lru_scan() to cover the nfsd_file_dispose_list_delayed() call. 2. Wrapping nfsd_file_close_inode() in nfsd_gc_lock so that all three callers of nfsd_file_dispose_list_delayed() hold the lock. 3. Adding a spin_lock/unlock(nfsd_gc_lock) barrier to ensure proper synchronization.

Defensive priority

Linux system administrators and security teams should prioritize verifying the presence of the fix in their kernel versions and reviewing system logs for potential exploitation attempts.

Recommended defensive actions

• Verify kernel version and apply patch if necessary
• Review system logs for potential exploitation attempts
• Monitor for updates from Linux kernel maintainers
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and associated source references provide details on the vulnerability, its impact, and the fixes applied to the Linux kernel. The vulnerability was introduced due to a race condition in the nfsd filecache, which could lead to a memory leak. The fix involves widening the nfsd_gc_lock and adding synchronization to prevent this issue. Linux system administrators and security teams should verify the presence of the fix in their kernel versions and review system logs for potential exploitation attempts. The fix involves 1. W

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.