CVE-2026-89661

NFSD: Prevent post-shutdown use-after-free in unlock_filesystem

Published Sep 11, 2026 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent post-shutdown use-after-free in unlock_filesystem

Writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs
nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the
handler confirms that nn->nfsd_serv is set. Once nfsd has shut down,
nfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the
pointer intact, so the cancel helper iterates freed slab memory as an
array of struct list_head and then dereferences a bogus nfs4_client
when it takes clp->async_lock. A local administrator holding
CAP_SYS_ADMIN can reach this use-after-free by stopping the server and
then writing to unlock_filesystem; KASAN reports a slab-use-after-free
read in nfsd4_cancel_copy_by_sb().

nfsd4_revoke_states() walks the same state tables and for that reason
already runs only under nfsd_mutex with nn->nfsd_serv confirmed
present. Move the async COPY cancel into that protected section so
every NFSv4 state-table walker on this path observes a running server.
Async copies exist only while the server runs, so gating the cancel on
nn->nfsd_serv loses nothing.

Analysis

Technical impact

A use‑after‑free flaw in the Linux kernel NFS server is triggered by writing to /proc/fs/nfsd/unlock_filesystem after the NFS daemon has stopped. The code path nfsd4_cancel_copy_by_sb() operates without holding the nfsd_mutex and before confirming nn->nfsd_serv, allowing it to dereference memory that has already been freed by nfs4_state_destroy_net(). This results in a slab‑use‑after‑free read that can corrupt kernel memory. A local administrator with CAP_SYS_ADMIN can trigger the flaw by stopping the server and then performing the write, as confirmed by KASAN reporting a slab‑use‑after‑free read.

Affected Systems

This flaw affects all Linux kernel implementations that expose the /proc/fs/nfsd/unlock_filesystem interface. The CPE identifier indicates the Linux kernel family and no specific affected version range is provided, so any kernel release prior to the patch is potentially impacted.

Risk and Exploitability

The CVSS score of 4.1 indicates low severity, and the EPSS score of < 1% reflects an extremely low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation requires local administrative privileges, the NFS daemon to be stopped, and the capability to write to /proc/fs/nfsd/unlock_filesystem. Given these strict conditions, the likelihood of real‑world exploitation is low, but the flaw can cause a system crash or memory corruption that damages kernel integrity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3daab3112f039cf849f96764019b096bb0a39d04`	affected	< 0c1a755b7212e0835398d4df5e782ea85ccd7476
`3daab3112f039cf849f96764019b096bb0a39d04`	affected	< 292d915d3ba6fd15eeb88351fa10581683073109

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[3daab3112f039cf849f96764019b096bb0a39d04,0c1a755b7212e0835398d4df5e782ea85ccd7476)`	affected	code_commit	—
`[3daab3112f039cf849f96764019b096bb0a39d04,292d915d3ba6fd15eeb88351fa10581683073109)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.0`	affected	generic	—
`[0,7.0)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the most recent Linux kernel update that includes the fix for the nfsd unlock_filesystem use‑after‑free.
If an immediate kernel upgrade is not possible, keep the NFS daemon running when using /proc/fs/nfsd/unlock_filesystem and avoid writing to the file after the server has been stopped.
Restrict write access to /proc/fs/nfsd/unlock_filesystem using security mechanisms such as SELinux or AppArmor so that only privileged processes can write to it.

Generated by OpenCVE AI on September 15, 2026 at 21:18 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.198% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c1a755b7212e0835398d4df5e782ea85ccd7476
https://git.kernel.org/stable/c/292d915d3ba6fd15eeb88351fa10581683073109
https://nvd.nist.gov/vuln/detail/CVE-2026-89661
https://www.cve.org/CVERecord?id=CVE-2026-89661

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89661 https://www.cve.org/CVERecord?id=CVE-2026-89661
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the handler confirms that nn->nfsd_serv is set. Once nfsd has shut down, nfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the pointer intact, so the cancel helper iterates freed slab memory as an array of struct list_head and then dereferences a bogus nfs4_client when it takes clp->async_lock. A local administrator holding CAP_SYS_ADMIN can reach this use-after-free by stopping the server and then writing to unlock_filesystem; KASAN reports a slab-use-after-free read in nfsd4_cancel_copy_by_sb(). nfsd4_revoke_states() walks the same state tables and for that reason already runs only under nfsd_mutex with nn->nfsd_serv confirmed present. Move the async COPY cancel into that protected section so every NFSv4 state-table walker on this path observes a running server. Async copies exist only while the server runs, so gating the cancel on nn->nfsd_serv loses nothing.
Title		NFSD: Prevent post-shutdown use-after-free in unlock_filesystem
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c1a755b7212e0835398d4df5e782ea85ccd7476 https://git.kernel.org/stable/c/292d915d3ba6fd15eeb88351fa10581683073109