CVE-2026-22989: Linux Kernel DOS Vulnerability

CVE-2026-22989 Overview

CVE-2026-22989 is a Linux kernel vulnerability in the NFS server (nfsd) subsystem. The flaw occurs when an administrator attempts to unlock a filesystem through the administrative interface while nfsd is not running. The kernel calls nfsd4_revoke_states(), which accesses state structures such as conf_id_hashtbl that have already been freed during server shutdown. This results in a use-after-free condition that crashes the kernel and produces a denial-of-service condition on the affected host. The vulnerability requires local access with low privileges and impacts kernel availability.

Critical Impact
A local user with access to the nfsd administrative interface can trigger a kernel crash by writing to the unlock filesystem control while the NFS server is stopped, producing a host-wide denial of service.

Affected Products

Linux Kernel 6.19-rc1
Linux Kernel 6.19-rc2
Linux Kernel 6.19-rc3 and 6.19-rc4

Discovery Timeline

2026-01-23 - CVE-2026-22989 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-22989

Vulnerability Analysis

The vulnerability resides in the write_unlock_fs code path within the Linux kernel nfsd module. When an administrator writes to the unlock filesystem control via nfsctl_transaction_write, the kernel invokes nfsd4_revoke_states() without verifying that the NFS server is currently running. If nfsd has been shut down, the state hash tables including conf_id_hashtbl have already been freed. Accessing these freed structures dereferences invalid memory and triggers a kernel oops.

The reported call trace shows the crash chain: nfsd4_revoke_states+0x1b4/0x898 invoked from write_unlock_fs+0x258/0x440, reached through nfsctl_transaction_write and vfs_write from a userspace write() syscall. The result is a kernel-level fault that takes down the host.

Root Cause

The root cause is a missing lifecycle check on the nfsd server before operating on its internal client state. The administrative write handler did not acquire nfsd_mutex nor verify server status, allowing operations on stale pointers after nfsd teardown released the underlying memory. This is a classic use-after-free pattern tied to subsystem shutdown ordering.

Attack Vector

Exploitation requires local access and the privileges needed to write to the nfsd filesystem control interface, typically root or a user with CAP_SYS_ADMIN. The attacker issues a write to the unlock filesystem control while nfsd is stopped. No remote network vector exists and no user interaction is required beyond the local write. The impact is limited to availability — the kernel does not lose confidentiality or integrity, but the host crashes.

The patch resolves the issue by taking nfsd_mutex and confirming the server is still up before invoking nfsd4_revoke_states(), holding the mutex across the call. See the upstream kernel commit for the corrected logic.

Detection Methods for CVE-2026-22989

Indicators of Compromise

Kernel oops or panic messages referencing nfsd4_revoke_states, write_unlock_fs, or nfsctl_transaction_write in dmesg or /var/log/kern.log.
Unexpected host reboots or service interruptions on systems running affected 6.19-rc kernels with nfsd administrative activity.
Audit log entries showing writes to /proc/fs/nfsd/ control files when nfsd is not active.

Detection Strategies

Monitor kernel ring buffer output for crash signatures matching the nfsd4_revoke_states+0x1b4 call trace.
Track write() syscalls targeting nfsd control files correlated with nfsd service state transitions.
Inventory hosts running Linux kernel 6.19-rc release candidates and confirm patch status against the upstream stable commits.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on nfsd subsystem panics.
Audit administrative use of nfsctl write operations and correlate with systemctl activity on the nfs-server service.
Review change management records to identify hosts running pre-release kernels in production environments.

How to Mitigate CVE-2026-22989

Immediate Actions Required

Upgrade the Linux kernel to a version containing the fix from commits d0424066, d95499900f, or e06c9f6c0f.
Restrict access to /proc/fs/nfsd/ control files to trusted administrative accounts only.
Avoid running 6.19-rc release-candidate kernels on production hosts that expose NFS server functionality.

Patch Information

The fix is published in the upstream Linux kernel stable tree. Refer to the first kernel commit, second kernel commit, and third kernel commit. The patch acquires nfsd_mutex and verifies that the server is still running before calling nfsd4_revoke_states().

Workarounds

Do not issue writes to the nfsd unlock filesystem interface while the nfsd service is stopped.
Enforce strict file permissions on /proc/fs/nfsd/ to limit administrative access.
Where feasible, disable the nfsd kernel module on hosts that do not export NFS shares.

bash

# Restrict access to nfsd control interface and verify service state before admin operations
systemctl status nfs-server
mount | grep nfsd
ls -l /proc/fs/nfsd/
# Only perform unlock operations when nfsd is active
systemctl is-active --quiet nfs-server && echo "nfsd running - safe to proceed" || echo "nfsd not running - abort unlock"