CVE-2026-89668: Linux Kernel NFSD Privilege Escalation

CVE-2026-89668 Overview

CVE-2026-89668 is a Linux kernel vulnerability in the NFS server (nfsd) module. The flaw stems from an initialization ordering error in init_nfsd(), where nfsd_debugfs_init() runs before nfsd4_init_slabs(). If the slab allocation fails, the code returns without calling nfsd_debugfs_exit(), leaving orphan debugfs files with stale file operations pointers referencing freed module text.

A local attacker able to trigger the failure path and subsequently access the orphaned debugfs entries could dereference stale function pointers into freed memory, enabling local code execution or kernel memory corruption.

Critical Impact
Stale debugfs file operations pointers into freed module text create a use-after-free condition in the Linux kernel nfsd module, threatening confidentiality, integrity, and availability of the host.

Affected Products

Linux kernel with the nfsd module compiled and enabled
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Systems where debugfs is mounted and the NFS server loads with a slab allocation failure

Discovery Timeline

2026-09-11 - CVE-2026-89668 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89668

Vulnerability Analysis

The vulnerability lives in the init_nfsd() module initialization routine of the Linux kernel NFS server. The function invokes nfsd_debugfs_init() to register debugfs entries before nfsd4_init_slabs() sets up the required slab caches. When slab allocation fails, init_nfsd() executes a bare return retval that bypasses nfsd_debugfs_exit().

The registered debugfs files remain visible in the debugfs filesystem after the module load fails. Their file_operations pointers still reference addresses inside the nfsd module text, which the kernel subsequently frees when the module is torn down. Any process opening or reading these orphaned files triggers a dereference into freed memory.

The upstream fix moves nfsd_debugfs_init() after nfsd4_init_slabs() succeeds and updates unwind paths to follow reverse-initialization (LIFO) order in both the init_nfsd() error path and exit_nfsd().

Root Cause

The root cause is an initialization ordering defect combined with an incomplete error-handling path. The bare early return on slab allocation failure omits the cleanup of previously registered debugfs entries, producing a use-after-free class flaw when those entries are later accessed.

Attack Vector

Exploitation requires local access with low privileges. The attacker must be able to reach the mounted debugfs filesystem, typically accessible only to privileged users, and trigger or wait for a scenario where slab initialization fails during nfsd module load. Once orphan debugfs files exist, opening them dereferences stale kernel function pointers.

No verified public exploit code is available for this issue. See the Linux kernel commit ab43ff94 for the corrective patch.

Detection Methods for CVE-2026-89668

Indicators of Compromise

Kernel log entries indicating nfsd module load failures accompanied by slab allocation errors
Presence of debugfs files under the nfsd subdirectory after a failed module initialization
Unexpected kernel oops or panic traces referencing freed nfsd module addresses

Detection Strategies

Audit running kernel versions against the fixed commits referenced in the stable kernel tree
Monitor dmesg for nfsd initialization failures and correlate with subsequent debugfs access events
Enable kernel memory sanitizers (KASAN) in test environments to surface use-after-free access on nfsd debugfs handlers

Monitoring Recommendations

Track kernel module load and unload events via auditd rules on init_module and delete_module syscalls
Alert on read or open operations targeting /sys/kernel/debug/nfsd/* following an nfsd load failure
Collect kernel crash dumps and forward them to a central analysis pipeline for review

How to Mitigate CVE-2026-89668

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the commit 4ae5d749 as soon as distribution updates are available
Restrict access to the debugfs mount point to the root user only
Disable automatic loading of the nfsd module on systems that do not require NFS server functionality

Patch Information

The fix is committed to the Linux stable tree in commits 2c390c8a1764, 4ae5d7490ae6, and ab43ff94f5df. Rebuild kernels from a source tree that includes these commits, or install distribution updates that backport them. Reference the Linux Kernel Commit ab43ff94 for the authoritative change.

Workarounds

Unmount debugfs on production systems where it is not required: umount /sys/kernel/debug
Blacklist the nfsd kernel module on hosts that do not export NFS shares
Enforce strict permissions on /sys/kernel/debug to prevent non-root reads while awaiting patch deployment

bash

# Configuration example: prevent nfsd autoload and restrict debugfs
echo "install nfsd /bin/true" | sudo tee /etc/modprobe.d/disable-nfsd.conf
sudo chmod 700 /sys/kernel/debug
sudo umount /sys/kernel/debug   # if debugfs is not required