CVE-2026-89675 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should be aware of this vulnerability. They should review and apply patches provided by the Linux kernel maintainers, update to a version of the Linux kernel that includes the fix, and monitor for potential exploitation attempts. Additionally, they should assess exposure and prioritize remediation for affected systems.

Why it matters

This vulnerability could allow an attacker to cause a use-after-free condition in the Linux kernel's nfsd subsystem, potentially leading to a denial of service or code execution. Defenders should prioritize patch application and monitor system logs for potential exploitation attempts.

• Verify patch application and kernel version updates.
• Monitor system logs for potential exploitation attempts.
• Assess exposure and prioritize remediation for affected systems.

Technical summary

The Linux kernel's nfsd subsystem is vulnerable to a use-after-free condition. An async copy could be freed or used after free while a teardown caller raced the copy kthread. This could lead to a use-after-free condition when accessing the copy's files. The vulnerability arises from a race condition between the async copy kthread and a teardown caller, which can cause the copy to be freed prematurely. This can result in a use-after-free condition when accessing the copy's files, potentially leading to a denial of service or code execution.

Defensive priority

High

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Update to a version of the Linux kernel that includes the fix.
• Monitor for potential exploitation attempts.
• Verify patch application and kernel version updates.
• Assess exposure and prioritize remediation for affected systems.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources. The official CVE Program record and NIST NVD detail page provide additional information about the vulnerability. The source item provides details about the vulnerability, but its description is null.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.