CVE-2026-89662 - Vulnerability Details

- NFSD: Prevent lock owner use-after-free during client teardown

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent lock owner use-after-free during client teardown

__destroy_client() releases a client's open owners, but a lock owner
whose only reference is a blocked lock (nbl) stays on
cl_ownerstr_hashtbl. client_has_state() does not count a bare owner,
so DESTROY_CLIENTID can reach __destroy_client() with such owners
present.

__destroy_client() then walks the table, calling remove_blocked_locks()
on each owner without a reference. Freeing a blocked lock drops the
owner reference held via flc_owner. The per-net laundromat reaps
blocked locks from nn->blocked_locks_lru independently of client state.
The two paths share blocked_locks_lock only for the list splice, not
the owner's lifetime. The laundromat therefore frees the owner as
__destroy_client() dereferences it, a NULL dereference in
remove_blocked_locks().

nfsd4_release_lockowner() holds a reference across the same call;
__destroy_client() does not. Hold cl_lock across the walk, taking a
reference and unhashing each owner, then drop it before
remove_blocked_locks() and nfs4_put_stateowner(), which take
blocked_locks_lock and cl_lock.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

NFSD cleans up lock owners during an NFS client teardown. A lock owner client is destroyed, the cleanup routine dereferences the owner after the blocked lock is freed, causing a null pointer dereference. This use‑after‑free flaw (CWE‑476) results in a kernel crash and therefore a denial of service on the affected system.

Affected Systems

All Linux kernels that have not yet are affected. The flaw resides in the NFS server module bundled with the kernel, so any distribution running an unpatched kernel that includes the NFSd subsystem is at risk. The specific CPE indicates all Linux kernel releases; individual distribution names are not listed.

Risk and Exploitability

The CVSS base score of 9.8 marks this flaw as critical, and the EPSS score of less than 1 percent suggests that exploitation attempts are currently rare. There are no publicly available exploits. Based on the description, the likely attack vector is an attacker who can trigger an NFS client teardown, such as by disconnecting clients or sending malformed NFS requests. The flaw is not listed in CISA’s KEV catalog, so the severity and potential for a full system crash mean that the risk should not be neglected.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`68ef3bc3166468678d5e1fdd216628c35bd1186f`	affected	< 42d7954b0a1907d4ef122aef94561952a033cdc3
`68ef3bc3166468678d5e1fdd216628c35bd1186f`	affected	< bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a
`68ef3bc3166468678d5e1fdd216628c35bd1186f`	affected	< b8bad5a11416b26cc7fd4b18fba46d75ff636558
`68ef3bc3166468678d5e1fdd216628c35bd1186f`	affected	< 1ce74d1b7770e69735e8f8e509807af4ff9c8ee7
`68ef3bc3166468678d5e1fdd216628c35bd1186f`	affected	< a6ead6fff3a7d03e49845f048f7000a2e0d34431
`68ef3bc3166468678d5e1fdd216628c35bd1186f`	affected	< 4804c58f73a80d12df1de323bf97a164f6ee8743
`68ef3bc3166468678d5e1fdd216628c35bd1186f`	affected	< 8cf4ff0a7c083dd5e0067f517d63979b74b66649
`68ef3bc3166468678d5e1fdd216628c35bd1186f`	affected	< 5e2fa29d223a9a1e6a948e40b109d09081d1decd
`e294c4c2d33b7307a89cdf31bec08a112d6a9297`	affected	—
`797bfd05d4040fbf766198b3cfcc1838002cc890`	affected	—
`0f44e9da465ea259b6c9f31a627f3c50a16e1679`	affected	—
`4.9.91`	affected	< 4.10
`4.14.31`	affected	< 4.15
`4.15.14`	affected	< 4.16

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[68ef3bc3166468678d5e1fdd216628c35bd1186f,a6ead6fff3a7d03e49845f048f7000a2e0d34431)`	affected	code_commit	—
`[68ef3bc3166468678d5e1fdd216628c35bd1186f,4804c58f73a80d12df1de323bf97a164f6ee8743)`	affected	code_commit	—
`[68ef3bc3166468678d5e1fdd216628c35bd1186f,8cf4ff0a7c083dd5e0067f517d63979b74b66649)`	affected	code_commit	—
`[68ef3bc3166468678d5e1fdd216628c35bd1186f,5e2fa29d223a9a1e6a948e40b109d09081d1decd)`	affected	code_commit	—
`e294c4c2d33b7307a89cdf31bec08a112d6a9297`	affected	code_commit	—
`797bfd05d4040fbf766198b3cfcc1838002cc890`	affected	code_commit	—
`0f44e9da465ea259b6c9f31a627f3c50a16e1679`	affected	code_commit	—
`[4.9.91,4.10)`	affected	semver	—
`[4.14.31,4.15)`	affected	semver	—
`[4.15.14,4.16)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.16`	affected	semver	—
`[0,4.16)`	unaffected	semver	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the NFSd lock‑owner patch
If the patch cannot be installed immediately, disable the NFS service or restrict it to trusted hosts only
Implement firewall rules to limit NFS traffic to known clients and enforce strong authentication to reduce the chance attacker triggering an unclean teardown

Generated by OpenCVE AI on September 15, 2026 at 20:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00734.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1ce74d1b7770e69735e8f8e509807af4ff9c8ee7
https://git.kernel.org/stable/c/42d7954b0a1907d4ef122aef94561952a033cdc3
https://git.kernel.org/stable/c/4804c58f73a80d12df1de323bf97a164f6ee8743
https://git.kernel.org/stable/c/5e2fa29d223a9a1e6a948e40b109d09081d1decd
https://git.kernel.org/stable/c/8cf4ff0a7c083dd5e0067f517d63979b74b66649
https://git.kernel.org/stable/c/a6ead6fff3a7d03e49845f048f7000a2e0d34431
https://git.kernel.org/stable/c/b8bad5a11416b26cc7fd4b18fba46d75ff636558
https://git.kernel.org/stable/c/bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a
https://nvd.nist.gov/vuln/detail/CVE-2026-89662
https://www.cve.org/CVERecord?id=CVE-2026-89662

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1ce74d1b7770e69735e8f8e509807af4ff9c8ee7 https://git.kernel.org/stable/c/42d7954b0a1907d4ef122aef94561952a033cdc3 https://git.kernel.org/stable/c/b8bad5a11416b26cc7fd4b18fba46d75ff636558 https://git.kernel.org/stable/c/bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89662 https://www.cve.org/CVERecord?id=CVE-2026-89662
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sat, 12 Sep 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present. __destroy_client() then walks the table, calling remove_blocked_locks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flc_owner. The per-net laundromat reaps blocked locks from nn->blocked_locks_lru independently of client state. The two paths share blocked_locks_lock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as __destroy_client() dereferences it, a NULL dereference in remove_blocked_locks(). nfsd4_release_lockowner() holds a reference across the same call; __destroy_client() does not. Hold cl_lock across the walk, taking a reference and unhashing each owner, then drop it before remove_blocked_locks() and nfs4_put_stateowner(), which take blocked_locks_lock and cl_lock.
Title		NFSD: Prevent lock owner use-after-free during client teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4804c58f73a80d12df1de323bf97a164f6ee8743 https://git.kernel.org/stable/c/5e2fa29d223a9a1e6a948e40b109d09081d1decd https://git.kernel.org/stable/c/8cf4ff0a7c083dd5e0067f517d63979b74b66649 https://git.kernel.org/stable/c/a6ead6fff3a7d03e49845f048f7000a2e0d34431

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:49.833Z

Updated: 2026-09-14T12:01:52.387Z

Reserved: 2026-09-11T19:38:34.744Z

Link: CVE-2026-89662

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:52.523

Modified: 2026-09-14T13:19:18.370

Link: CVE-2026-89662

Redhat

Severity : Important

Publid Date: 2026-09-11T19:45:49Z

Links: CVE-2026-89662 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:45:20Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object