CVE-2026-89709: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89709 Overview

CVE-2026-89709 is a Linux kernel race condition in the lockd and nfsd subsystems. The nlmsvc_ops pointer is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() using plain stores. Meanwhile, lockd dereferences the pointer without synchronization from dispatch sites in fs/lockd/svcsubs.c. Because the pointer targets nfsd's .rodata and its callback functions live in nfsd's .text, a stale load after rmmod nfsd produces either a NULL dereference or a use-after-free against module text.

Critical Impact
An unsynchronized module teardown race can trigger kernel memory corruption or crashes, threatening the confidentiality, integrity, and availability of Linux NFS servers.

Affected Products

Linux kernel builds shipping the lockd and nfsd modules prior to the referenced stable commits
Linux distributions providing NFS server functionality via loadable nfsd modules
Systems permitting privileged module unload of nfsd during active NLM (Network Lock Manager) dispatch

Discovery Timeline

2026-09-11 - CVE-2026-89709 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89709

Vulnerability Analysis

The defect is a kernel race condition [CWE-362] between nfsd module teardown and concurrent NLM dispatch in lockd. The nlmsvc_ops pointer references data and functions owned by the nfsd module. When nfsd_lockd_shutdown() clears the pointer using a plain store, no memory barrier or grace period protects readers. A concurrent NLM request handler in lockd may load a stale value and invoke a function whose text has been unmapped by rmmod nfsd.

The consequence is either a NULL pointer dereference or execution against freed module text, both of which produce a kernel oops. On systems where module text pages are recycled, the reader may follow an indirect call into attacker-influenced content, expanding impact beyond denial of service.

Root Cause

The root cause is missing RCU (Read-Copy-Update) protection around a cross-module function pointer. Publication and teardown of nlmsvc_ops used plain stores, while dispatch sites dereferenced the pointer without any read-side primitive. There was also no module reference count preventing nfsd from unloading while lockd held a pointer into its address space.

Attack Vector

Triggering the flaw requires an active NLM dispatch racing with an rmmod nfsd operation. NLM requests can be delivered by remote NFSv3 clients, which produces the network attack surface. Successful exploitation additionally depends on a local action or automation that unloads the nfsd module while inbound NLM traffic is in flight. High attack complexity reflects this narrow race window.

The published fix declares nlmsvc_ops as __rcu, publishes it via rcu_assign_pointer(), and clears it using RCU_INIT_POINTER() followed by synchronize_rcu(). A struct module *owner field is added to nlmsvc_binding, and dispatch pins the module across indirect calls with try_module_get() and module_put(). Teardown falls back to fput() to avoid leaking struct file references. See the upstream commits for the complete patch:

Detection Methods for CVE-2026-89709

Indicators of Compromise

Kernel oops or panic messages referencing nlmsvc_ops, nlmsvc_binding, or dispatch functions inside fs/lockd/svcsubs.c
NULL pointer dereference stack traces originating from lockd shortly after nfsd module unload events
dmesg entries showing general protection fault or BUG: unable to handle page fault in module text ranges previously mapped to nfsd

Detection Strategies

Monitor /var/log/kern.log and journalctl -k output for oops signatures involving lockd symbols immediately following rmmod nfsd
Audit host telemetry for sequences where the nfsd module is unloaded while NLM listeners remain reachable on TCP/UDP 111 and the NLM ports
Correlate NFS client disconnects and NLM lock reclaim failures with kernel fault events on the server

Monitoring Recommendations

Enable kdump on NFS servers to capture crash dumps for post-incident analysis of any suspected exploitation
Track module load and unload events via auditd rules on the init_module and delete_module syscalls
Alert on unexpected nfsd service restarts or repeated soft lockups on hosts exporting NFS

How to Mitigate CVE-2026-89709

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 3c461a1 and 641e5e2 as soon as your distribution publishes them
Restrict CAP_SYS_MODULE on NFS servers to prevent unprivileged or automated unloading of the nfsd module
Where feasible, build nfsd into the kernel or blacklist rmmod operations against it on production file servers

Patch Information

The fix is delivered through two upstream Linux kernel commits that add RCU protection and module pinning around nlmsvc_ops dispatch. Distribution-specific backports should be tracked through vendor security advisories:

Workarounds

Avoid unloading the nfsd module while the NFS service is active or reachable by clients
Segment NFS servers behind firewall rules that limit NLM traffic to known client subnets, reducing race exposure
Schedule module maintenance only after draining NLM traffic and confirming lockd has no in-flight dispatch

bash

# Prevent runtime unload of the nfsd module on production NFS servers
echo 'install nfsd /bin/true' | sudo tee /etc/modprobe.d/nfsd-noload.conf
# Verify the running kernel version after applying the vendor patch
uname -r
# Audit module unload attempts
sudo auditctl -a always,exit -F arch=b64 -S delete_module -k module_unload