CVE-2026-89682 - Vulnerability Details

- nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads
via a per-net freeme queue, preventing the shrinker and GC worker from
bearing the cost of closing files (see ffb402596147). However, the
queue lives in a separately-allocated struct nfsd_fcache_disposal that
is freed by nfsd_free_fcache_disposal_net() during per-net teardown.
The global shrinker, laundrette, and fsnotify callbacks can still be
inside nfsd_file_dispose_list_delayed() dereferencing that pointer,
causing a use-after-free.

Inline the spinlock and freeme list directly into struct nfsd_net (as
fcache_dispose_lock and fcache_dispose_list), eliminating the separately
allocated struct nfsd_fcache_disposal entirely. These fields now have
the same lifetime as the net namespace itself, so there is no dangling
pointer to chase.

nfsd_file_cache_start_net() now just initializes the inline fields and
cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains
the inline list directly instead of freeing a separate struct. The
alloc/free helpers are removed.

Published: 2026-09-11

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free flaw in the file cache disposal path of the Linux NFS daemon. When a net namespace teardown frees a structure that is still being processed by another kernel thread, a dangling pointer can be dereferenced, resulting in kernel memory corruption. The weakness is identified as CWE‑825.

Affected Systems

All Linux kernels that run the NFS daemon and are missing the commit that inlines the fcache disposal state into the nfsd_net structure are affected. The vendor is Linux and the product is the Linux kernel. No explicit version range is provided, so any kernel prior to the inclusion of the fix is potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. Based on the description, it is inferred that exploitation would require local or privileged access to the host and could result in kernel memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1463b38e7cf34d4cc60f41daff459ad807b2e408`	affected	< ba0ee9e04b7a0356c28d5a2fe445db675d24e572
`1463b38e7cf34d4cc60f41daff459ad807b2e408`	affected	< cadc9036d5a8209f89e7026ddba7cfb1c716b03c
`1463b38e7cf34d4cc60f41daff459ad807b2e408`	affected	< bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4
`e8f923e1e9fcc0832a12c8a2461792e5a9544c03`	affected	—
`3bc94fb44f10ef852723e1aeaac6794c5ab16aec`	affected	—
`5.10.220`	affected	< 5.11
`5.15.154`	affected	< 5.16

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1463b38e7cf34d4cc60f41daff459ad807b2e408,ba0ee9e04b7a0356c28d5a2fe445db675d24e572)`	affected	code_commit	—
`[1463b38e7cf34d4cc60f41daff459ad807b2e408,cadc9036d5a8209f89e7026ddba7cfb1c716b03c)`	affected	code_commit	—
`[1463b38e7cf34d4cc60f41daff459ad807b2e408,bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4)`	affected	code_commit	—
`e8f923e1e9fcc0832a12c8a2461792e5a9544c03`	affected	code_commit	—
`3bc94fb44f10ef852723e1aeaac6794c5ab16aec`	affected	code_commit	—
`[5.10.220,5.11)`	affected	semver	—
`[5.15.154,5.16)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	semver	—
`[0,5.17)`	unaffected	semver	—
`[6.18.51,7.0.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the system to a Linux kernel version that includes the fcache_disposal UAF fix
Reboot the machine so the patched kernel is loaded
Restart the NFS service to ensure it operates with the new code

Generated by OpenCVE AI on September 15, 2026 at 20:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00534.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572
https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4
https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c
https://nvd.nist.gov/vuln/detail/CVE-2026-89682
https://www.cve.org/CVERecord?id=CVE-2026-89682

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89682 https://www.cve.org/CVERecord?id=CVE-2026-89682
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing files (see ffb402596147). However, the queue lives in a separately-allocated struct nfsd_fcache_disposal that is freed by nfsd_free_fcache_disposal_net() during per-net teardown. The global shrinker, laundrette, and fsnotify callbacks can still be inside nfsd_file_dispose_list_delayed() dereferencing that pointer, causing a use-after-free. Inline the spinlock and freeme list directly into struct nfsd_net (as fcache_dispose_lock and fcache_dispose_list), eliminating the separately allocated struct nfsd_fcache_disposal entirely. These fields now have the same lifetime as the net namespace itself, so there is no dangling pointer to chase. nfsd_file_cache_start_net() now just initializes the inline fields and cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains the inline list directly instead of freeing a separate struct. The alloc/free helpers are removed.
Title		nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572 https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4 https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:04.882Z

Updated: 2026-09-13T06:33:06.103Z

Reserved: 2026-09-11T19:38:34.748Z

Link: CVE-2026-89682

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:55.043

Modified: 2026-09-13T07:17:34.003

Link: CVE-2026-89682

Redhat

Severity : Important

Publid Date: 2026-09-11T19:46:04Z

Links: CVE-2026-89682 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:30:10Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object