CVE-2026-89659: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89659 Overview

CVE-2026-89659 is a use-after-free vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw resides in the delegation revocation path handled by nfs4_laundromat(). A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep the client structure alive. When an expired delegation is unhashed from cl_delegations and before revoke_delegation() relinks it onto cl_revoked, the client can be freed. A subsequent dereference of cl_lock operates on freed memory. The bug affects networked NFS server deployments and is reachable from remote NFS clients through normal delegation timeout behavior.

Critical Impact
Remote attackers with NFS access can trigger a use-after-free in kernel memory, potentially leading to kernel memory corruption, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux kernel versions containing the vulnerable NFSD delegation logic prior to the referenced stable commits
Linux distributions shipping NFSv4 server functionality
Systems exporting NFSv4 shares with delegation support enabled

Discovery Timeline

2026-09-11 - CVE-2026-89659 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89659

Vulnerability Analysis

The vulnerability exists in the Linux kernel NFSD subsystem, specifically in the delegation lifecycle management performed by nfs4_laundromat(). Delegation stateids reference their owning nfs4_client through a bare pointer without holding a reference count. Client lifetime is normally preserved because __destroy_client() drains both cl_delegations and cl_revoked before free_client() executes. The laundromat routine violates this invariant during expired delegation processing.

Root Cause

The laundromat unhashes an expired delegation from cl_delegations, releases deleg_lock, then calls revoke_delegation() to relink the delegation onto cl_revoked under cl_lock. Between those two operations, the delegation belongs to neither list. During this window, client_has_state() returns false, indicating no remaining state. Because teardown paths only require cl_rpc_users to reach zero and the laundromat holds no such reference, the client can proceed to free_client() while revoke_delegation() is still about to dereference cl_lock. This is a classic use-after-free race [CWE-416].

Attack Vector

An attacker with NFSv4 client access to a vulnerable server can request delegations, then trigger recall timeouts to force the server into the vulnerable revocation path. Concurrent client teardown operations, such as client expiration due to lease timeout, race against the laundromat thread. Successful exploitation corrupts kernel memory. The attack requires no authentication beyond the ability to mount NFS exports and issue normal protocol operations. No verified public exploit code is available at this time. Refer to the Linux Kernel Commit 2a9d637 for the fix implementation.

Detection Methods for CVE-2026-89659

Indicators of Compromise

Kernel oops or panic messages referencing nfs4_laundromat, revoke_delegation, or cl_lock in dmesg output
KASAN reports flagging use-after-free in the NFSD delegation code path
Unexpected NFS server crashes or reboots coinciding with client delegation recall events

Detection Strategies

Monitor kernel logs on NFS servers for stack traces involving nfsd, nfs4_laundromat, and revoke_delegation symbols
Deploy KASAN-enabled kernels in test environments to surface the race condition during fuzzing
Correlate NFSv4 delegation recall timeouts with subsequent kernel instability across the fleet

Monitoring Recommendations

Aggregate /var/log/kern.log and journald kernel messages centrally and alert on NFSD-related fault signatures
Track NFS server uptime and unplanned reboots as a leading indicator of exploitation attempts
Audit NFSv4 client source addresses connecting to exported shares to identify anomalous session churn

How to Mitigate CVE-2026-89659

Immediate Actions Required

Inventory all Linux systems running NFSD with NFSv4 exports and prioritize patching
Apply the upstream stable kernel updates that include the delegation reference-counting fix
Restrict NFS export access to trusted network segments using firewall rules and /etc/exports host restrictions

Patch Information

The fix pins the client with cl_rpc_users across the revoke operation so teardown blocks until revocation completes, then reaps the delegation from cl_revoked. Apply kernels containing the upstream commits: Linux Kernel Commit 2a9d637, Linux Kernel Commit 3c0a53ee, and Linux Kernel Commit 4683ca76. Distribution vendors will backport these commits into their supported kernel branches.

Workarounds

Disable NFSv4 delegations on the server by setting /proc/sys/fs/leases-enable to 0 where operationally acceptable
Limit NFS service exposure to internal management networks and block ports 111 and 2049 at perimeter firewalls
Reduce NFSv4 lease time to shorten the race window if disabling delegations is not feasible

bash

# Configuration example - disable file leases to prevent delegation issuance
echo 0 > /proc/sys/fs/leases-enable

# Restrict NFS exports to trusted subnet in /etc/exports
# /export 10.0.0.0/24(rw,sync,no_subtree_check)
exportfs -ra

# Firewall NFS ports at the host level
iptables -A INPUT -p tcp --dport 2049 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP