CVE-2026-89660: Linux Kernel NFSD Use-After-Free Vulnerability

CVE-2026-89660 Overview

CVE-2026-89660 is a use-after-free vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw occurs during administrative state revocation when nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(). A concurrent teardown can free the nfs4_client structure before the revocation routine dereferences it to read clp->cl_minorversion, leading to a use-after-free condition. The vulnerability affects NFSv4 server deployments and can be triggered over the network without authentication.

Critical Impact
Remote attackers can trigger memory corruption in the NFS server, potentially leading to kernel crashes, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux kernel NFSD subsystem (NFSv4 server implementation)
Distributions shipping vulnerable kernel versions prior to the patch commits
Systems exposing NFSv4 services with administrative state management enabled

Discovery Timeline

2026-09-11 - CVE-2026-89660 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89660

Vulnerability Analysis

The vulnerability resides in the NFSv4 server's state management logic within the Linux kernel. A stateid holds only a bare pointer to its associated nfs4_client; the stateid reference does not pin the client structure. The client survives only because __destroy_client() drains its stateids before free_client() executes.

The flaw emerges when nfsd4_revoke_states() releases nn->client_lock while calling revoke_one_stid(). That callee dereferences the client pointer to revoke a stateid and read clp->cl_minorversion. A teardown path racing against the dropped lock can free the client before the read completes, producing a use-after-free.

The patch introduces reference pinning through cl_rpc_users under client_lock. This blocks DESTROY_CLIENTID and EXCHANGE_ID teardown paths, which refuse to proceed while cl_rpc_users is non-zero. Because force_expire_client() ignores this counter after its initial wait, the fix skips clients whose cl_time is already zero and pins cl_rpc_users before dropping the lock.

Root Cause

The root cause is inadequate lifetime management between stateid revocation and client teardown paths. The stateid reference model does not pin the parent nfs4_client object, and the revocation walk drops the protecting spinlock before completing pointer dereferences. This creates a classic race window where concurrent expiry can invalidate the pointer.

Attack Vector

Exploitation requires network access to an NFSv4 server and the ability to induce concurrent state operations. An attacker triggers administrative state revocation while racing client teardown operations such as DESTROY_CLIENTID or forced expiry. Successful exploitation corrupts kernel memory and can escalate from denial of service to kernel-mode code execution.

No verified public exploit code is available. Refer to the kernel commit fix for technical details of the race condition.

Detection Methods for CVE-2026-89660

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nfsd4_revoke_states, revoke_one_stid, or nfs4_client in /var/log/messages or dmesg output
KASAN or SLUB debug reports flagging use-after-free access in the NFSD subsystem
Repeated NFSv4 client expiry events correlating with server instability or crash-reboot cycles

Detection Strategies

Monitor kernel ring buffer output for NFSD-related fault traces and correlate with NFSv4 session churn
Enable KASAN on test kernels to surface the exact race path if reproduction is required
Track NFSv4 EXCHANGE_ID and DESTROY_CLIENTID operation rates for anomalous bursts that may indicate exploitation attempts

Monitoring Recommendations

Aggregate kernel crash telemetry and NFSD audit logs into a centralized data lake for correlation across fleet
Alert on unplanned NFS server restarts on hosts exposing NFSv4 to untrusted networks
Baseline normal NFSv4 client lifecycle patterns to identify race-inducing traffic

How to Mitigate CVE-2026-89660

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected NFS servers
Restrict NFSv4 exposure to trusted network segments using firewall rules until patching completes
Audit hosts running NFSD to confirm kernel version and patch status

Patch Information

The fix landed in the mainline Linux kernel via three related commits. Review the Kernel Git Commit Update, the Kernel Git Commit Fix, and the Kernel Git Commit Improvement for the complete patch series. Distribution vendors are expected to backport the fix to supported stable kernel branches.

Workarounds

Disable NFSv4 services on hosts where the protocol is not required by stopping and masking the nfs-server unit
Enforce network-layer access controls limiting TCP port 2049 to authorized clients only
Where feasible, downgrade exported shares to NFSv3 until the kernel patch is deployed

bash

# Verify installed kernel version and disable NFSv4 exports where possible
uname -r
systemctl stop nfs-server
systemctl mask nfs-server

# Restrict NFSv4 traffic at the host firewall
iptables -A INPUT -p tcp --dport 2049 -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP