CVE-2026-89667: Linux Kernel Race Condition Vulnerability

CVE-2026-89667 Overview

CVE-2026-89667 is a race condition in the Linux kernel nfsd (NFS server) filecache subsystem. The shrinker, garbage collection (GC) worker, and fsnotify/lease callbacks can unhash an nfsd_file from the rhashtable and then call nfsd_file_dispose_list_delayed() to move it to the per-net dispose list. If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk misses the already-unhashed file. The per-net dispose list drain then completes before the file is queued, leaving the file and its associated state orphaned and leaked.

Critical Impact
Concurrent NFS server per-net shutdown and filecache disposal can leak file objects and NFS state, corrupting resource accounting on multi-tenant NFS servers.

Affected Products

Linux kernel nfsd (NFS server) subsystem
Kernel builds prior to the commits referenced below
Distributions shipping vulnerable stable kernels

Discovery Timeline

2026-09-11 - CVE-2026-89667 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89667

Vulnerability Analysis

The defect is a race between three asynchronous filecache producers and the per-net shutdown consumer. The shrinker and GC worker acquire nfsd_gc_lock while walking the LRU list. In the original code, they release the lock before calling nfsd_file_dispose_list_delayed(). The fsnotify/lease path, implemented in nfsd_file_close_inode(), holds no synchronization at all.

When nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk cannot observe files that have already been unhashed but not yet queued to the per-net dispose list. The shutdown then drains the per-net list before the in-flight file arrives. The stranded file has no worker thread to release it, leaking both the nfsd_file and the NFS state it references.

Root Cause

The root cause is insufficient locking scope around the transition from rhashtable removal to per-net dispose list insertion. Because unhash and enqueue are not atomic with respect to shutdown, the shutdown path misses in-flight objects. This is a classic time-of-check to time-of-use (TOCTOU) pattern in kernel resource lifecycle management.

Attack Vector

Exploitation requires triggering concurrent filecache disposal and per-net container shutdown on a Linux NFS server. A local or network-adjacent attacker with the ability to induce NFS filecache churn (open/close cycles, lease breaks, memory pressure) alongside network namespace teardown can provoke the race. Successful triggering produces persistent kernel resource leaks that degrade the server over time and can affect integrity of NFS state tracking.

Refer to the upstream fix commits for technical details:

Detection Methods for CVE-2026-89667

Indicators of Compromise

Growing kernel memory attributable to nfsd_file allocations without a corresponding rise in active NFS clients.
NFS state (open files, locks, leases) that persists after the owning network namespace or NFS server instance is torn down.
Unexplained increases in slab usage for filecache-related caches reported by /proc/slabinfo.

Detection Strategies

Track kernel version and patch level across Linux NFS servers and compare against the fix commits 08af9593, 40162cfe, and 6d6b9f6a.
Correlate NFS server metrics with container or network namespace lifecycle events to identify shutdown-adjacent leaks.
Enable nfsd tracepoints to observe filecache dispose paths during shutdown transitions.

Monitoring Recommendations

Monitor nfsd slab caches and long-running kernel memory trends on file servers.
Alert on repeated per-net NFS shutdown events on hosts that also perform frequent filecache eviction.
Ingest kernel logs and NFS server telemetry into a centralized analytics platform for longitudinal review.

How to Mitigate CVE-2026-89667

Immediate Actions Required

Inventory all Linux hosts running the in-kernel NFS server (nfsd) and identify kernels missing the referenced fix commits.
Prioritize patching multi-tenant systems that create and destroy network namespaces hosting NFS exports.
Reduce NFS server churn on unpatched hosts by limiting namespace teardown while file activity is high.

Patch Information

Apply the upstream Linux kernel fix, which widens nfsd_gc_lock in nfsd_file_gc() and nfsd_file_lru_scan() to cover the nfsd_file_dispose_list_delayed() call, wraps nfsd_file_close_inode() in nfsd_gc_lock, and adds a spin_lock/spin_unlock(nfsd_gc_lock) barrier in nfsd_file_cache_shutdown_net() after the purge. Upgrade to a distribution kernel that includes commits 08af9593, 40162cfe, and 6d6b9f6a.

Workarounds

Where patching is not immediately possible, avoid tearing down network namespaces that host active NFS exports during periods of heavy file activity.
Restrict the ability of untrusted local workloads to trigger namespace shutdown alongside NFS I/O.
Reboot NFS servers on a scheduled basis to reclaim leaked filecache memory until the patched kernel is deployed.