CVE-2026-89690: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89690 Overview

CVE-2026-89690 is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the rpc_status netlink dumpit handler, which walks in-flight svc_rqst structures under rcu_read_lock and reads opnums from args->ops[] for NFSv4 compound requests. The args->ops buffer is a separate vmalloc allocation freed synchronously by vfree() in nfsd4_release_compoundargs() at compound completion. Because the free is not deferred across an RCU grace period, a concurrent compound completion can free the buffer while the dumpit reads it, producing a use-after-free on vmalloc memory.

Critical Impact
A local user with permission to query the nfsd rpc_status netlink interface can trigger memory corruption on an NFS server, leading to kernel information disclosure, denial of service, or potential privilege escalation.

Affected Products

Linux kernel builds with CONFIG_NFSD enabled that expose the rpc_status netlink dumpit interface
Distributions shipping vulnerable stable kernels prior to the fixed commits listed in the upstream stable tree
Server systems running the in-kernel NFSv4 server (nfsd)

Discovery Timeline

2026-09-11 - CVE-2026-89690 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89690

Vulnerability Analysis

The nfsd rpc_status netlink dumpit iterates active svc_rqst objects under rcu_read_lock to report on in-flight RPC operations. For NFSv4 compound requests, the dumpit dereferences args->ops[] to extract operation numbers for each op in the compound. The svc_rqst structure itself is freed via kfree_rcu, so the RCU read-side critical section correctly pins that object. The args->ops buffer, however, is allocated separately via vmalloc and released by a synchronous vfree() call inside nfsd4_release_compoundargs() when the compound completes.

Because vfree() returns memory to the vmalloc allocator immediately without waiting for an RCU grace period, a second CPU processing compound completion can free the ops buffer while the dumpit CPU is still reading from it. The trailing smp_load_acquire on rq_status_counter used as a seqcount recheck cannot retroactively invalidate a load that has already retired against freed memory. This is a classic use-after-free [CWE-416] on kernel virtual memory.

The upstream fix replaces vfree(args->ops) with kvfree_rcu_mightsleep(), deferring the free until after an RCU grace period. Completed compound op buffers up to 200 * sizeof(struct nfsd4_op) persist for one grace period before reclamation.

Root Cause

The root cause is missing RCU-deferred reclamation for a buffer read inside an RCU read-side critical section. Only the containing svc_rqst was protected by kfree_rcu, while its embedded vmalloc buffer used synchronous vfree(), breaking the RCU protection contract.

Attack Vector

Exploitation requires local access with privileges sufficient to open the nfsd netlink family and issue rpc_status dump commands. An attacker races repeated dumpit invocations against ongoing NFSv4 compound traffic to hit the free window on the args->ops buffer, producing kernel memory corruption on an active NFS server.

No public proof-of-concept exploit is currently available. See the upstream commits for technical fix details: Linux Kernel Commit 19413cc, Linux Kernel Commit 48f72af, Linux Kernel Commit 6703199, and Linux Kernel Commit fca26a3.

Detection Methods for CVE-2026-89690

Indicators of Compromise

Kernel oops or panic messages referencing nfsd4_release_compoundargs, nfsd_nl_rpc_status_get_dumpit, or vmalloc-region faults
KASAN use-after-free reports on kernel builds with sanitizers enabled, citing args->ops or nfsd4_op structures
Unexpected nfsd worker thread crashes correlated with concurrent netlink activity on the nfsd family

Detection Strategies

Inventory Linux hosts running nfsd and compare running kernel versions against the fixed stable commits referenced upstream
Alert on unprivileged or unexpected processes opening netlink sockets to the nfsd generic netlink family
Correlate kernel ring buffer entries containing nfsd, BUG:, or KASAN with local user session activity

Monitoring Recommendations

Forward /var/log/kern.log and dmesg output into a centralized log store and alert on nfsd-related fault signatures
Track process invocations of tools capable of issuing generic netlink dumps (ss, genl, custom binaries) on NFS servers
Baseline NFS server uptime and worker restart frequency to detect anomalous nfsd crashes

How to Mitigate CVE-2026-89690

Immediate Actions Required

Apply the vendor-provided kernel update that includes the kvfree_rcu_mightsleep() fix on all NFS servers
Restrict local shell access on NFS servers to trusted administrators only, reducing exposure to the local attack vector
Where feasible, disable the in-kernel nfsd service on hosts that do not require NFSv4 export functionality

Patch Information

The fix replaces the synchronous vfree(args->ops) in nfsd4_release_compoundargs() with kvfree_rcu_mightsleep(), deferring reclamation across an RCU grace period. Fixed commits are available in the upstream stable tree: 19413cc, 48f72af, 6703199, and fca26a3. Consult your distribution's security advisories for backported package versions.

Workarounds

Limit access to the nfsd generic netlink family via kernel capability enforcement, allowing only CAP_NET_ADMIN holders
Unload the nfsd kernel module on systems that do not export NFS shares to eliminate the vulnerable code path
Monitor and rate-limit invocation of rpc_status netlink dumps until patched kernels are deployed

bash

# Verify running kernel version and nfsd module status
uname -r
lsmod | grep nfsd

# If nfsd is not required, disable and unload
systemctl disable --now nfs-server
rmmod nfsd

# Confirm distribution package includes the fix (example for Debian/Ubuntu)
apt list --installed 2>/dev/null | grep linux-image