CVE-2026-89661: Linux Kernel NFSD Use-After-Free Vulnerability

CVE-2026-89661 Overview

CVE-2026-89661 is a use-after-free vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw exists in the handling of writes to /proc/fs/nfsd/unlock_filesystem, which invokes nfsd4_cancel_copy_by_sb() before acquiring nfsd_mutex and before confirming that nn->nfsd_serv is set. After NFSD shuts down, nfs4_state_destroy_net() frees nn->conf_id_hashtbl but leaves the pointer intact. The cancel helper then iterates freed slab memory and dereferences a bogus nfs4_client structure when acquiring clp->async_lock.

Critical Impact
A local administrator with CAP_SYS_ADMIN can trigger a slab use-after-free in the kernel by stopping the NFS server and writing to unlock_filesystem, potentially leading to kernel memory corruption.

Affected Products

Linux kernel with NFSD subsystem enabled
Distributions shipping vulnerable NFSD builds prior to the upstream fix
Systems exposing /proc/fs/nfsd/unlock_filesystem to privileged administrators

Discovery Timeline

2026-09-11 - CVE-2026-89661 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89661

Vulnerability Analysis

The vulnerability resides in the NFSD path that handles writes to /proc/fs/nfsd/unlock_filesystem. The handler calls nfsd4_cancel_copy_by_sb() without first holding nfsd_mutex and without validating that the server context nn->nfsd_serv remains active. This ordering assumption breaks after NFSD shutdown.

When NFSD shuts down, nfs4_state_destroy_net() releases nn->conf_id_hashtbl but does not reset the pointer to NULL. Subsequent calls into nfsd4_cancel_copy_by_sb() walk what is now freed slab memory, treating it as an array of struct list_head. The walker then dereferences an attacker-influenceable nfs4_client pointer when acquiring clp->async_lock, producing a slab use-after-free that KASAN reports as a read.

Root Cause

The root cause is missing synchronization and liveness validation on a state-table walker. Unlike nfsd4_revoke_states(), which walks the same tables only under nfsd_mutex and only after confirming nn->nfsd_serv, the async COPY cancel path performed neither check. Freed hashtable memory therefore remained reachable through a dangling pointer after teardown.

Attack Vector

A local user holding CAP_SYS_ADMIN stops the NFS server, then writes a filesystem path to /proc/fs/nfsd/unlock_filesystem. The handler enters nfsd4_cancel_copy_by_sb(), iterates freed hashtable slots, and dereferences reclaimed slab memory. Because the freed memory can be repurposed by other kernel allocations, this primitive can be leveraged for kernel information disclosure, denial of service, or potential privilege escalation depending on heap grooming.

No verified proof-of-concept code is publicly linked in the advisory. The upstream fix moves the async COPY cancel into the section already guarded by nfsd_mutex with nn->nfsd_serv confirmed present. Async copies exist only while the server runs, so gating the cancel on nn->nfsd_serv does not lose functionality. See the Kernel Git Change 0c1a755 and Kernel Git Change 292d915 for the applied patches.

Detection Methods for CVE-2026-89661

Indicators of Compromise

KASAN reports flagging slab-use-after-free read in nfsd4_cancel_copy_by_sb() in kernel logs.
Kernel oops or panic traces referencing nfsd4_cancel_copy_by_sb, conf_id_hashtbl, or async_lock after NFSD shutdown.
Writes to /proc/fs/nfsd/unlock_filesystem shortly after rpc.nfsd 0 or systemd stop actions against nfs-server.service.

Detection Strategies

Enable KASAN on test and pre-production kernels to catch slab use-after-free reads on this code path.
Audit /proc/fs/nfsd/unlock_filesystem writes using Linux Audit rules and correlate against NFSD start/stop events.
Alert on kernel ring buffer messages containing nfsd4_cancel_copy_by_sb following NFSD teardown transitions.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log store and alert on NFSD-related KASAN or BUG traces.
Monitor privileged process activity that toggles NFSD state combined with subsequent writes to NFSD procfs entries.
Track kernel version inventory across Linux fleets to identify hosts still running pre-patch NFSD builds.

How to Mitigate CVE-2026-89661

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 0c1a755b7212 and 292d915d3ba6 and reboot into the fixed kernel.
Restrict CAP_SYS_ADMIN to a minimal set of administrative accounts and services.
On multi-tenant hosts, disable NFSD (systemctl disable --now nfs-server) if it is not required.

Patch Information

The fix moves the async COPY cancel into the section already protected by nfsd_mutex and gated on nn->nfsd_serv. This ensures every NFSv4 state-table walker on the unlock_filesystem path observes a running server. Patches are available via the stable kernel tree: Kernel Git Change 0c1a755 and Kernel Git Change 292d915. Consume the fix through your distribution's kernel security update channel.

Workarounds

Avoid writing to /proc/fs/nfsd/unlock_filesystem after stopping the NFS server; keep NFSD running until administrative sequences complete.
Constrain administrator workflows and automation so they do not invoke unlock_filesystem outside of an active NFSD lifecycle.
Use mandatory access control (SELinux or AppArmor) policies to restrict which processes can open NFSD control files.

bash

# Verify kernel version and NFSD service state before and after patching
uname -r
systemctl status nfs-server

# Audit writes to the vulnerable procfs entry
auditctl -w /proc/fs/nfsd/unlock_filesystem -p wa -k nfsd_unlock_fs