CVE-2026-89689: Linux Kernel NFSD Use-After-Free Vulnerability

CVE-2026-89689 Overview

CVE-2026-89689 is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd4_sequence(), which can free the session slot it is actively processing when the session shrinker reduces se_target_maxslots below se_fchannel.maxreqs. A remote NFSv4.1+ client using a slot in the shrink boundary range can trigger the free path, leaving cstate->slot as a dangling pointer. Subsequent writes by nfsd4_store_cache_entry() corrupt whatever slab object now occupies the freed memory, enabling memory corruption over the network.

Critical Impact
Remote, unauthenticated slab corruption in the Linux kernel NFS server can lead to code execution, privilege escalation, or denial of service against NFSv4.1+ file servers.

Affected Products

Linux kernel with nfsd (NFSv4.1+ session support) enabled
Stable kernel branches patched via commits 72d40b1, b449b13, and f5d22e3
Distributions shipping vulnerable NFS server builds prior to backport

Discovery Timeline

2026-09-11 - CVE-2026-89689 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89689

Vulnerability Analysis

The vulnerability is a use-after-free ([CWE-416]) in the NFSv4 session slot management logic. When the session shrinker reduces se_target_maxslots below the current se_fchannel.maxreqs, the shrink path evaluates three gating conditions before invoking free_session_slots(). It verifies that shrinking was advertised, that slot->sl_generation matches se_slot_gen, and that the client acknowledges the reduction via seq->maxslots <= se_target_maxslots.

Critically, seq->slotid is never validated against se_target_maxslots. A client operating on a slot in the range [se_target_maxslots, maxreqs) can satisfy every gating check while still holding a slot scheduled for release. free_session_slots() then calls kfree() on every slot at index >= se_target_maxslots, including the caller's active slot.

Root Cause

After the free, execution continues to write sl_seqid, sl_flags, and sl_generation through the dangling pointer and stores it in cstate->slot. nfsd4_store_cache_entry() later copies up to maxresp_cached bytes of the compound reply into the freed sl_data[] array, corrupting the slab object now residing at that address. A second race exists: free_session_slots() does not test NFSD4_SLOT_INUSE, so a concurrent thread already past SEQUENCE on a different high-numbered slot can have its slot freed underneath it.

Attack Vector

Exploitation requires network reachability to the NFS server and the ability to establish an NFSv4.1+ session. An attacker crafts SEQUENCE operations that select a slot id in the shrink boundary window and acknowledges the reduced maxslots, triggering the free of the in-use slot. The reply-cache write path then provides attacker-controlled bytes into freed slab memory. See the upstream fix commits for the exact patched conditionals.

No verified public exploit code is available. Refer to the kernel commit 72d40b1, commit b449b13, and commit f5d22e3 for the corrective logic.

Detection Methods for CVE-2026-89689

Indicators of Compromise

Kernel oops or general protection fault traces referencing nfsd4_sequence, free_session_slots, or nfsd4_store_cache_entry.
KASAN reports indicating use-after-free in slab caches used by NFSv4 session slot allocations.
Unexpected NFS server crashes correlated with active NFSv4.1+ client sessions and session shrink events.

Detection Strategies

Enable KASAN and slab debugging on test kernels to surface the use-after-free at the point of free or first reuse.
Monitor NFSv4 SEQUENCE traffic for clients repeatedly using high-numbered slotid values combined with reduced sa_highest_slotid acknowledgements.
Alert on repeated nfsd worker crashes or kernel panics on file server hosts.

Monitoring Recommendations

Ship dmesg, /var/log/kern.log, and crash-dump metadata from NFS servers into a centralized log platform for correlation.
Track running kernel versions against distribution advisories to identify hosts still exposed to CVE-2026-89689.
Baseline expected NFSv4 client behavior and flag anomalous session-slot usage patterns from untrusted subnets.

How to Mitigate CVE-2026-89689

Immediate Actions Required

Apply the upstream kernel fix or the vendor-provided backport that adds the seq->slotid bounds check and the NFSD4_SLOT_INUSE scan in free_session_slots().
Restrict NFS server exposure to trusted network segments using firewall rules until patched kernels are deployed.
Prioritize patching internet-adjacent or multi-tenant NFS servers where untrusted clients can negotiate NFSv4.1+ sessions.

Patch Information

The fix is delivered via stable kernel commits 72d40b1, b449b13, and f5d22e3. The patch enforces that the current request's slotid sits below the shrink boundary and defers the shrink when any slot in the to-be-freed range has NFSD4_SLOT_INUSE set.

Workarounds

Disable the NFS server (nfsd) on hosts that do not require it until patched kernels are installed.
Constrain NFSv4 access with host-based and network-level ACLs to limit which clients can initiate SEQUENCE operations.
Where feasible, restrict clients to NFSv3, which does not use the vulnerable NFSv4.1 session slot machinery.

bash

# Restrict nfsd exposure with firewalld until patched kernel is deployed
sudo firewall-cmd --permanent --zone=public --remove-service=nfs
sudo firewall-cmd --permanent --zone=internal --add-service=nfs
sudo firewall-cmd --permanent --zone=internal --add-source=10.0.0.0/8
sudo firewall-cmd --reload

# Verify running kernel against fixed version after patching
uname -r