CVE-2026-89682: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89682 Overview

CVE-2026-89682 is a use-after-free (UAF) vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd_file_dispose_list_delayed(), which defers fput() calls to nfsd service threads through a per-net freeme queue. The queue lived inside a separately allocated struct nfsd_fcache_disposal that was freed by nfsd_free_fcache_disposal_net() during per-net teardown. The global shrinker, laundrette worker, and fsnotify callbacks could still dereference that pointer after the free, producing a UAF condition on active NFS servers.

Critical Impact
Successful exploitation may allow remote attackers to corrupt kernel memory on Linux systems exporting NFS shares, potentially leading to privilege escalation, denial of service, or arbitrary kernel code execution.

Affected Products

Linux kernel with nfsd subsystem enabled
Systems exporting NFS shares using the kernel NFS server
Distributions shipping affected kernel versions prior to the patched commits

Discovery Timeline

2026-09-11 - CVE-2026-89682 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89682

Vulnerability Analysis

The vulnerability is a use-after-free in the Linux kernel NFS server's file cache disposal path. nfsd_file_dispose_list_delayed() was designed to move the cost of closing files off the shrinker and garbage collection worker by handing deferred fput() work to nfsd service threads via a per-net freeme queue. That queue lived in a separately allocated struct nfsd_fcache_disposal, whose lifetime did not match the code paths that referenced it.

During per-net teardown, nfsd_free_fcache_disposal_net() freed the disposal structure. However, the global shrinker, the laundrette worker, and fsnotify callbacks could still be executing inside nfsd_file_dispose_list_delayed() and holding a reference to the now-freed structure. The subsequent dereference of the dangling pointer manifests as a classic UAF.

The fix inlines the spinlock and freeme list directly into struct nfsd_net as fcache_dispose_lock and fcache_dispose_list, tying the fields to the lifetime of the network namespace itself. nfsd_file_cache_start_net() now only initializes inline fields and cannot fail on allocation, and nfsd_file_cache_shutdown_net() drains the inline list directly.

Root Cause

The root cause is a lifetime mismatch between the struct nfsd_fcache_disposal allocation and the concurrent kernel contexts that reference it. Teardown freed the structure without ensuring all shrinker, GC, and fsnotify code paths had drained, leaving dangling pointers reachable from multiple execution contexts.

Attack Vector

Exploitation requires triggering NFS server per-net teardown while concurrent shrinker or fsnotify activity is in flight on the same file cache. An attacker with network access to an NFS export can generate the file operations needed to keep the disposal queue populated, then race namespace teardown to hit the freed structure. Successful exploitation may yield kernel memory corruption suitable for privilege escalation or denial of service.

See the upstream fixes for technical details: Kernel Git Commit ba0ee9e0, Kernel Git Commit bbf13732, and Kernel Git Commit cadc9036.

Detection Methods for CVE-2026-89682

Indicators of Compromise

Kernel oops or panic messages referencing nfsd_file_dispose_list_delayed, nfsd_free_fcache_disposal_net, or nfsd_fcache_disposal in dmesg or /var/log/messages.
KASAN reports flagging use-after-free reads or writes inside the nfsd file cache disposal path.
Unexpected NFS server crashes or hangs correlated with network namespace teardown events.

Detection Strategies

Enable KASAN on test kernels to surface UAF conditions in nfsd file cache code paths before production impact.
Correlate NFS export lifecycle events (container or namespace teardown) with subsequent kernel warnings or crashes.
Track running kernel build IDs against the fixed commits ba0ee9e0, bbf13732, and cadc9036 in a configuration management database.

Monitoring Recommendations

Ingest kernel logs into a centralized SIEM and alert on stack traces containing nfsd_file_ symbols.
Monitor NFS-serving hosts for unplanned reboots or kdump captures involving the file cache subsystem.
Audit which hosts export NFS and prioritize those systems in the vulnerability management workflow.

How to Mitigate CVE-2026-89682

Immediate Actions Required

Identify all Linux hosts running the in-kernel NFS server (nfsd) and inventory their kernel versions.
Apply vendor-provided kernel updates that include the upstream commits ba0ee9e0, bbf13732, and cadc9036.
Restrict network access to NFS ports (TCP/UDP 2049 and related RPC ports) to trusted client subnets only.

Patch Information

The fix inlines fcache_dispose_lock and fcache_dispose_list directly into struct nfsd_net, eliminating the separately allocated struct nfsd_fcache_disposal entirely. Apply kernel updates that incorporate the upstream commits ba0ee9e0, bbf13732, and cadc9036. Consult your Linux distribution's security advisories for backported package versions.

Workarounds

Where NFS export is not required, unload the nfsd module and disable the NFS server service until patches are applied.
Firewall NFS and RPC ports at the host and network perimeter to limit reachable attack surface.
Avoid frequent creation and teardown of network namespaces on hosts running unpatched nfsd to reduce race window exposure.

bash

# Configuration example: disable nfsd where not required
systemctl stop nfs-server
systemctl disable nfs-server
modprobe -r nfsd

# Restrict NFS port exposure with firewalld
firewall-cmd --permanent --remove-service=nfs
firewall-cmd --permanent --remove-service=rpc-bind
firewall-cmd --permanent --remove-service=mountd
firewall-cmd --reload