CVE-2026-89688: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89688 Overview

CVE-2026-89688 is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfs4_preprocess_seqid_op(), where incorrect reference counting during a seqid_op replay retry can trigger a stateowner refcount underflow. When nfsd4_cstate_assign_replay() returns -EAGAIN because the replay owner is being torn down (RP_UNHASHED), the error path incorrectly calls nfs4_put_stateowner() on a reference it never acquired. The mismatched release corrupts the stateowner reference count and leaks the stid reference, opening a path to use-after-free conditions and stalled concurrent close operations against nfsd4_close_open_stateid().

Critical Impact
Remote unauthenticated attackers reachable to an NFSv4 server may trigger memory corruption in kernel space, enabling denial of service and potential arbitrary code execution in the kernel context.

Affected Products

Linux kernel with NFSv4 server (nfsd) support enabled
Distributions shipping vulnerable stable kernel branches prior to the fix commits
Systems exporting NFSv4 shares over the network

Discovery Timeline

2026-09-11 - CVE-2026-89688 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89688

Vulnerability Analysis

The defect lives in the NFSv4 sequence-id operation preprocessing path. nfs4_preprocess_seqid_op() acquires the stateid through nfsd4_lookup_stateid(), which increments the sc_count reference on the nfs4_stid structure but takes no reference on the associated stateowner. The helper openlockstateid() performs only a cast and similarly does not acquire a stateowner reference.

When the replay path calls nfsd4_cstate_assign_replay() and the replay owner is being torn down, the function returns -EAGAIN with the RP_UNHASHED state. Along this path no stateowner reference is acquired. The subsequent error handler, however, calls nfs4_put_stateowner(stp->st_stateowner), decrementing so_count for a reference it never held. This produces a refcount underflow and the possibility of freeing the stateowner while other threads still access it.

A secondary consequence is that the sc_count reference on the stid is leaked. The leak can stall a concurrent nfsd4_close_open_stateid() operation waiting for sc_count to reach zero, producing a persistent denial of service on the export.

Root Cause

The root cause is asymmetric reference-count handling between acquisition and release. The lookup path acquires a reference on the stid only, but the retry error path releases a reference on the stateowner. Because the stateowner remains alive only through the reference held by the stid, the correct release on the retry path is the stid itself.

Attack Vector

The vulnerability is reachable over the network by any client that can issue NFSv4 seqid_op requests to the vulnerable server. Triggering the condition requires racing state teardown with a replay request so that nfsd4_cstate_assign_replay() observes RP_UNHASHED and returns -EAGAIN. Successful exploitation corrupts kernel refcount state and can free memory still referenced by concurrent close paths.

No verified public proof-of-concept is available. Refer to the upstream fix commits (00843074, 5e4627d3, 69ed78b6, and f7cb90dd) for the exact code paths.

Detection Methods for CVE-2026-89688

Indicators of Compromise

Kernel warnings or oops messages referencing nfs4_put_stateowner, nfs4_preprocess_seqid_op, or nfsd4_close_open_stateid in dmesg and /var/log/messages.
Refcount underflow warnings (refcount_t: underflow) originating from the nfsd module.
NFSv4 clients experiencing hangs on CLOSE operations against an otherwise responsive server.

Detection Strategies

Monitor kernel ring buffers on NFS servers for stack traces containing nfs4_preprocess_seqid_op or NFSv4 state machine symbols.
Correlate NFSv4 client-side timeouts on CLOSE and OPEN_DOWNGRADE operations with server-side nfsd thread stalls.
Track kernel version and patch state across the Linux fleet to identify hosts still running vulnerable nfsd code paths.

Monitoring Recommendations

Alert on repeated NFSv4 replay traffic patterns from a single client, which may indicate attempts to race state teardown.
Instrument NFS server hosts with kernel crash reporting (kdump, systemd-coredump) to capture forensic data if the flaw is triggered.
Baseline normal nfsd thread counts and flag prolonged blocked threads waiting on state reference counts.

How to Mitigate CVE-2026-89688

Immediate Actions Required

Inventory all Linux hosts exporting NFSv4 shares and identify kernel versions in use.
Apply the vendor-provided kernel update containing the upstream fix as soon as it is available for your distribution.
Restrict NFSv4 exports to trusted network segments using firewall rules or /etc/exports host restrictions until patched.

Patch Information

The vulnerability is resolved by dropping the reference actually held — the stid — before retrying, so that the stateowner remains alive through the reference held by the stid. The fix mirrors the balance used in nfsd4_process_open1(). The upstream corrections are available in kernel commits 00843074, 5e4627d3, 69ed78b6, and f7cb90dd.

Workarounds

Disable the NFSv4 server on hosts that do not require it by unloading the nfsd module and stopping the nfs-server service.
Limit NFSv4 client access using firewall policies to trusted management networks only.
Where feasible, downgrade exports to NFSv3, which does not exercise the affected NFSv4 state machine code path.

bash

# Restrict NFS to a trusted subnet with firewalld until patched
sudo firewall-cmd --permanent --zone=drop --add-service=nfs
sudo firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/24
sudo firewall-cmd --permanent --zone=trusted --add-service=nfs
sudo firewall-cmd --reload

# Or stop NFSv4 entirely on hosts that do not require it
sudo systemctl stop nfs-server
sudo systemctl disable nfs-server