CVE-2026-89667

nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

Published Sep 11, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

The shrinker, GC worker, and fsnotify/lease callbacks can unhash an
nfsd_file from the rhashtable and then call
nfsd_file_dispose_list_delayed() to move it to the per-net dispose list.
If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk
misses the already-unhashed file, and its drain of the per-net dispose
list can run before the file has been queued. The file then sits on
the per-net list with no thread to drain it, leaking both the file and
its associated state.

The GC worker and shrinker already hold nfsd_gc_lock while walking the
LRU, but in the original code they release it before calling
nfsd_file_dispose_list_delayed(). The fsnotify/lease path
(nfsd_file_close_inode) has no synchronization at all.

Fix this by:

1. Widening nfsd_gc_lock in both nfsd_file_gc() and nfsd_file_lru_scan()
to cover the nfsd_file_dispose_list_delayed() call.

2. Wrapping nfsd_file_close_inode() in nfsd_gc_lock so that all three
callers of nfsd_file_dispose_list_delayed() hold the lock.

3. Adding a spin_lock/unlock(nfsd_gc_lock) barrier in
nfsd_file_cache_shutdown_net() after the purge, so that any
in-progress disposal has fully completed before the per-net list
is drained.

All operations inside the lock are non-sleeping (rhashtable lookups,
atomic bit/refcount ops, list moves, svc_wake_up), so the spinlock is
appropriate.

Analysis

Technical impact

The vulnerability resides in the NFS daemon’s handling of file cache cleanup. When a cached NFS file is removed by the shrinker, garbage‑collector worker, or fsnotify callbacks, the file can be unhashed from the reference map and then deferred to a per‑network disposal list. If the net‑shut‑down routine runs concurrently, it may miss the unhashed entry and drain the disposal list before the file has been queued, leaving the file and its associated kernel state stranded. The leaked objects accumulate in memory, potentially exhausting resources and degrading system availability. The weakness is identified as CWE‑772, an unreleased resource cycle.

Affected Systems

The Linux kernel’s NFS daemon component is affected. Any kernel build that does not include the documented fix is vulnerable. No specific version ranges are listed, so all current distribution kernels may need verification.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a very low likelihood of exploitation in the wild. This is a kernel‑level flaw that requires either local or privileged access to the NFS daemon; the likely attack vector is local exploitation or compromise of a privileged process. An attacker who can trigger the race condition could cause uncontrolled memory growth and eventual service disruption.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ffb402596147ac583f3464ff5c48feb9423e3838`	affected	< b15997b53b61c74fb4d083f7261d19f389ff854f
`ffb402596147ac583f3464ff5c48feb9423e3838`	affected	< 6d6b9f6a75c3767250e9c23ace4e384ab8f7843e
`ffb402596147ac583f3464ff5c48feb9423e3838`	affected	< 08af9593e2b472fd98c00faf1bf03bdbb7203477
`ffb402596147ac583f3464ff5c48feb9423e3838`	affected	< 40162cfea79b9510380decfdd1795b754dc9f972

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.111`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[ffb402596147ac583f3464ff5c48feb9423e3838,6d6b9f6a75c3767250e9c23ace4e384ab8f7843e)`	affected	code_commit	—
`[ffb402596147ac583f3464ff5c48feb9423e3838,08af9593e2b472fd98c00faf1bf03bdbb7203477)`	affected	code_commit	—
`[ffb402596147ac583f3464ff5c48feb9423e3838,40162cfea79b9510380decfdd1795b754dc9f972)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.9`	affected	generic	—
`[0,6.9)`	unaffected	generic	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch which widens the nfsd_gc_lock, wraps nfsd_file_close_inode in that lock, and adds a spin_lock barrier in nfsd_file_cache_shutdown_net().
If an updated kernel is not immediately available, temporarily disable the NFS daemon or restrict its file cache size to reduce the chance of a runaway leak.
Continuously monitor system memory usage and examine kernel logs for indications of NFS‑abnormal memory growth is observed.

Generated by OpenCVE AI on September 15, 2026 at 20:42 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.537% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/08af9593e2b472fd98c00faf1bf03bdbb7203477
https://git.kernel.org/stable/c/40162cfea79b9510380decfdd1795b754dc9f972
https://git.kernel.org/stable/c/6d6b9f6a75c3767250e9c23ace4e384ab8f7843e
https://git.kernel.org/stable/c/b15997b53b61c74fb4d083f7261d19f389ff854f
https://nvd.nist.gov/vuln/detail/CVE-2026-89667
https://www.cve.org/CVERecord?id=CVE-2026-89667

History

Sep 21, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b15997b53b61c74fb4d083f7261d19f389ff854f

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89667 https://www.cve.org/CVERecord?id=CVE-2026-89667
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd_file from the rhashtable and then call nfsd_file_dispose_list_delayed() to move it to the per-net dispose list. If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk misses the already-unhashed file, and its drain of the per-net dispose list can run before the file has been queued. The file then sits on the per-net list with no thread to drain it, leaking both the file and its associated state. The GC worker and shrinker already hold nfsd_gc_lock while walking the LRU, but in the original code they release it before calling nfsd_file_dispose_list_delayed(). The fsnotify/lease path (nfsd_file_close_inode) has no synchronization at all. Fix this by: 1. Widening nfsd_gc_lock in both nfsd_file_gc() and nfsd_file_lru_scan() to cover the nfsd_file_dispose_list_delayed() call. 2. Wrapping nfsd_file_close_inode() in nfsd_gc_lock so that all three callers of nfsd_file_dispose_list_delayed() hold the lock. 3. Adding a spin_lock/unlock(nfsd_gc_lock) barrier in nfsd_file_cache_shutdown_net() after the purge, so that any in-progress disposal has fully completed before the per-net list is drained. All operations inside the lock are non-sleeping (rhashtable lookups, atomic bit/refcount ops, list moves, svc_wake_up), so the spinlock is appropriate.
Title		nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/08af9593e2b472fd98c00faf1bf03bdbb7203477 https://git.kernel.org/stable/c/40162cfea79b9510380decfdd1795b754dc9f972 https://git.kernel.org/stable/c/6d6b9f6a75c3767250e9c23ace4e384ab8f7843e