CVE-2026-89708: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89708 Overview

CVE-2026-89708 is a use-after-free vulnerability in the Linux kernel NFS server (nfsd) subsystem. The flaw resides in the NFSv4.1 callback path, where the per-session teardown routine can free a session while rpciod still holds an inflight callback rpc_task that dereferences clp->cl_cb_session. After a DESTROY_SESSION operation, nfsd4_probe_callback_sync() flushes cl_callback_wq, but once nfsd4_run_cb_work() has invoked rpc_call_async() the task lives on rpciod and is not covered by the workqueue flush. A second window in nfsd4_process_cb_update() leaves cl_cb_session pointing at an about-to-be-freed session. The issue has been resolved upstream.

Critical Impact
A remote network-based attacker interacting with an NFSv4.1 server can trigger a use-after-free on the freed session slab, enabling kernel memory corruption with potential impact to confidentiality, integrity, and availability.

Affected Products

Linux kernel nfsd subsystem implementing NFSv4.1 session callbacks
Distributions shipping vulnerable upstream kernels prior to the fix commits
Systems exposing NFSv4.1 server functionality over the network

Discovery Timeline

2026-09-11 - CVE-2026-89708 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89708

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) in the NFSv4.1 backchannel/callback path within the Linux kernel nfsd module. When a client issues DESTROY_SESSION, the destroy path calls unhash_session(), nfsd4_probe_callback_sync(), nfsd4_put_session_locked(), and finally free_session() which invokes kfree() on the session structure. However, nfsd4_probe_callback_sync() only flushes cl_callback_wq; it does not wait for callback rpc_task instances that have already been submitted to rpciod through rpc_call_async().

rpc_shutdown_client() attempts to drain rpciod tasks with a one-second wait_event_timeout, but tasks stuck in rpc_delay() (for example, two-second NFS4ERR_DELAY retries) can outlive the drain. Once the session slab is freed, nfsd4_cb_sequence_done() still reads cb_clp->cl_cb_session, dereferencing freed memory.

Root Cause

The root cause is missing lifetime synchronization between the session teardown path and inflight callback RPC tasks running on rpciod. The pointer clp->cl_cb_session was neither RCU-protected nor guarded against concurrent free. A second race exists in nfsd4_process_cb_update(): when __nfsd4_find_backchannel() returns NULL because unhash_session() has already removed the destroyed session, setup_callback_client() takes the v4.1 early return, so the cl_cb_session = ses assignment never occurs and the field retains a dangling pointer to the session about to be freed.

Attack Vector

The attack vector is network-based. A remote NFSv4.1 client that can establish a session and induce the appropriate teardown sequence, particularly one that keeps callback tasks stalled in rpc_delay() retry loops during DESTROY_SESSION, can drive the race. Successful exploitation results in kernel-mode use-after-free on the session slab, which may yield denial of service or memory corruption suitable for further exploitation.

The upstream fix converts cl_cb_session to an RCU-protected pointer annotated with __rcu, moves publication of the assignment to after rpc_create() succeeds using rcu_assign_pointer(), clears the pointer on error paths, and switches __free_session() from kfree() to kfree_rcu() so that the session slab is not reclaimed until after an RCU grace period. Reader sites including encode_cb_sequence4args(), decode_cb_sequence4resok(), nfsd41_cb_get_slot(), nfsd41_cb_release_slot(), nfsd4_cb_prepare(), and nfsd4_cb_sequence_done() now use rcu_read_lock() and rcu_dereference() with NULL checks. See the kernel commit 01c5d5f5, commit 13bdd486, and commit f164eb52 for the complete patch series.

Detection Methods for CVE-2026-89708

Indicators of Compromise

Kernel oops or KASAN reports referencing nfsd4_cb_sequence_done, encode_cb_sequence4args, or decode_cb_sequence4resok with use-after-free signatures on the session slab.
Unexpected nfsd crashes correlated with NFSv4.1 DESTROY_SESSION operations from clients.
Repeated NFS4ERR_DELAY responses immediately preceding session teardown from the same client.

Detection Strategies

Enable KASAN on test kernels and replay suspect NFSv4.1 client workloads to surface use-after-free reports in the callback path.
Monitor dmesg and kernel crash telemetry for panics originating in fs/nfsd/nfs4callback.c.
Audit installed kernel packages against distribution advisories referencing the three upstream commits.

Monitoring Recommendations

Ingest kernel logs and crash dumps into a central analytics platform and alert on nfsd-related oops or KASAN traces.
Track NFSv4.1 session churn per client, alerting on abnormal CREATE_SESSION/DESTROY_SESSION volumes.
Correlate NFS server restarts with recent client activity to identify probing behavior against the callback path.

How to Mitigate CVE-2026-89708

Immediate Actions Required

Update Linux kernels on all NFS server hosts to a version that includes the three referenced upstream fix commits.
Restrict network reachability of NFSv4.1 servers to trusted client subnets using firewall or network segmentation controls.
Prioritize patching on internet-exposed or multi-tenant file servers where untrusted NFSv4.1 clients can connect.

Patch Information

The fix is available upstream in the Linux kernel stable trees via commits 01c5d5f5, 13bdd486, and f164eb52. Apply the vendor kernel update from your Linux distribution once it incorporates these commits, then reboot affected NFS server hosts to load the patched kernel.

Workarounds

Disable NFSv4.1 and restrict clients to NFSv3 where operationally feasible until patched kernels are deployed.
Stop and disable the nfs-server service on hosts that do not require NFS export functionality.
Enforce network ACLs limiting TCP/UDP port 2049 access to a minimal set of authenticated clients.

bash

# Confirm running kernel and disable NFSv4.1 on the server if patching is delayed
uname -r

# /etc/nfs.conf - disable NFSv4.1 minor version on the server
[nfsd]
vers4=y
vers4.0=y
vers4.1=n
vers4.2=n

# Reload configuration
systemctl restart nfs-server