CVE-2026-89485: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89485 Overview

CVE-2026-89485 is a use-after-free vulnerability in the Linux kernel's lockd subsystem, which implements the Network Lock Manager (NLM) protocol for NFS file locking. The flaw resides in nlm_traverse_files(), where the iterator pins the current file with f_count++ across a mutex_unlock() for nlm_inspect_file(), but fails to pin the saved next pointer. A concurrent nlm_release_file() can free the next file during the unlock window, causing the iterator to dereference freed memory on the following loop step.

Critical Impact
A network-adjacent attacker can trigger memory corruption in the kernel's NFS locking subsystem, potentially leading to denial of service or arbitrary code execution in kernel context.

Affected Products

Linux kernel versions containing the vulnerable nlm_traverse_files() implementation in fs/lockd/
Systems providing NFS server functionality with lockd enabled
Distributions shipping affected upstream kernel revisions prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-89485 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89485

Vulnerability Analysis

The vulnerability exists in nlm_traverse_files(), a function that iterates over files tracked by the kernel's NFS lock manager. During each iteration, the function increments the reference count on the current file (f_count++) before dropping the surrounding mutex to call nlm_inspect_file(). This pinning protects the current entry from concurrent release.

The saved next pointer receives no such protection. While the mutex is held elsewhere by nlm_release_file(), the next file in the hash bucket can be freed via kfree(). When nlm_traverse_files() reacquires the lock and advances the cursor, it dereferences a dangling pointer into freed slab memory.

The upstream fix pins both the current and next files before dropping the lock, then advances by swapping the pinned cursors at the end of each iteration so the next entry is always held alive across the unlock window. The patch also replaces cached f_locks checks with nlm_file_inuse(), which performs a live walk of the inode lock list to correctly evaluate skipped files.

Root Cause

The root cause is missing reference-count protection on the iterator's lookahead pointer across a lock-drop boundary. The original code assumed the next pointer remained valid after mutex_unlock(), but the NLM file table permits concurrent removal by nlm_release_file(). This is a classic use-after-free pattern created by lifetime assumptions that do not hold under concurrent mutation.

Attack Vector

Exploitation requires the ability to induce concurrent NLM file table activity on a system running the vulnerable lockd implementation. A remote NFS client that can issue lock, unlock, and release operations against an NFS server can race nlm_release_file() against nlm_traverse_files() to trigger the free of the next-pointer target during the mutex-unlock window. The subsequent dereference produces kernel memory corruption, which can manifest as a crash or, with heap grooming, controlled write primitives in kernel space.

No verified proof-of-concept code is publicly available. Technical details of the fix are documented in the referenced kernel commits, including Kernel Commit 08a455f and Kernel Commit 41f0a6d.

Detection Methods for CVE-2026-89485

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nlm_traverse_files, nlm_inspect_file, or nlm_release_file in dmesg or /var/log/messages
KASAN use-after-free reports pointing to fs/lockd/svcsubs.c on kernels built with sanitizers enabled
Unexplained lockd kernel thread crashes on NFS servers under lock-heavy workloads

Detection Strategies

Inventory NFS server hosts and cross-reference running kernel versions against the fixed stable branches referenced in the upstream commits
Enable kernel address sanitizer (KASAN) in test environments to surface the use-after-free during fuzzing of NLM operations
Monitor for repeated lockd service restarts or NFS lock reclaim storms, which may indicate exploitation attempts or triggered crashes

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG:, KASAN, or general protection fault entries involving lockd symbols
Track NFS RPC statistics via nfsstat -s for anomalous spikes in lock, unlock, and release traffic from single clients
Audit which network segments can reach the NFS lockd ports (typically 4045/tcp,udp or dynamically assigned via rpcbind) and log connection attempts from unexpected sources

How to Mitigate CVE-2026-89485

Immediate Actions Required

Identify all Linux systems providing NFS server functionality and prioritize them for kernel updates
Apply the vendor-supplied kernel package containing the upstream fix commits and reboot affected hosts
Restrict network access to lockd and rpcbind ports so only trusted NFS clients can reach them

Patch Information

The fix is available in multiple upstream stable branches. Refer to the following commits: Kernel Commit 08a455f, Kernel Commit 350087f, Kernel Commit 41f0a6d, Kernel Commit 526c49c, Kernel Commit 550c192, Kernel Commit c24bdb7, Kernel Commit e3c413f, and Kernel Commit e999a88. Consult your distribution vendor for the specific packaged kernel version incorporating these backports.

Workarounds

Where NFS is not required, disable the nfs-server and rpc-statd services and unload the lockd module
Enforce firewall rules restricting NFS lock manager ports to a defined allowlist of NFS clients
Reduce exposure by mounting NFS shares over Kerberos-authenticated transports and limiting anonymous access

bash

# Example: restrict lockd exposure via firewalld until patched
sudo firewall-cmd --permanent --remove-service=nfs
sudo firewall-cmd --permanent --remove-service=rpc-bind
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" service name="nfs" accept'
sudo firewall-cmd --reload

# Verify running kernel against fixed stable branch
uname -r