CVE-2026-89689 - Vulnerability Details

- nfsd: don't free session slots that are still in use

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: don't free session slots that are still in use

nfsd4_sequence() can free the very slot it is currently processing.
When the session shrinker has reduced se_target_maxslots below
se_fchannel.maxreqs, the shrink path checks three conditions before
calling free_session_slots():

1. se_target_maxslots < maxreqs (shrink was advertised)
2. slot->sl_generation == se_slot_gen (slot is up-to-date)
3. seq->maxslots <= se_target_maxslots (client acknowledges)

However, seq->slotid is never checked against se_target_maxslots.
A client using a slot in the range [se_target_maxslots, maxreqs) can
satisfy all three conditions: its slot has the current generation
(set by a prior SEQUENCE), and it sends sa_highest_slotid <=
se_target_maxslots to acknowledge the reduction.

free_session_slots() then kfrees every slot at index >=
se_target_maxslots, including the caller's own slot. The function
continues to write sl_seqid, sl_flags, sl_generation, and stores the
dangling pointer in cstate->slot. Later, nfsd4_store_cache_entry()
copies up to maxresp_cached bytes of the compound reply into the freed
sl_data[] array, corrupting whatever slab object now occupies that
address.

Additionally, a concurrent thread processing SEQUENCE on a different
high-numbered slot can have its slot freed out from under it.
NFSD4_SLOT_INUSE is set under nn->client_lock before the lock is
released, so any concurrent thread past SEQUENCE will have its slot
marked. However, free_session_slots() does not check NFSD4_SLOT_INUSE
before freeing.

Fix both problems by:
1. Checking that the current request's slotid is below the shrink
boundary.
2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and
deferring the shrink if any are active.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel NFS daemon can release a session slot while it is still being used, because the session shrinker checks the target maximum slots but does not verify that the calling slot itself is below the shrink boundary or that it is not marked in use. This flaw, identified as CWE‑825, allows an attacker to trigger a use‑after‑free that corrupts kernel memory by writing to a freed slot later in the request handling path.

Affected Systems

All Linux kernel versions earlier than the patch that includes the nfsd4_sequence and free_session_slots fixes are vulnerable. Servers that expose an NFSv4 service run the specific code path that can be abused. The affected platform is the Linux kernel as indicated by the CPE string.

Risk and Exploitability

The CVSS score of 9.8 indicates Critical severity, but the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation has been observed. The most probable attack vector is through a malicious NFSv4 client that sends a SEQUENCE request with a slot ID that lies outside the allowed range, forcing the server to free a slot that it still uses and causing kernel memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7`	affected	< 72d40b103bb03f0124d3a3c8f71a30cbafaf6afa
`fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7`	affected	< b449b134e7762ddf98653a4b1d3e76d2d212ea64
`fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7`	affected	< f5d22e372f4ac3eb287037a488c29691d52a6330

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7,72d40b103bb03f0124d3a3c8f71a30cbafaf6afa)`	affected	code_commit	—
`[fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7,b449b134e7762ddf98653a4b1d3e76d2d212ea64)`	affected	code_commit	—
`[fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7,f5d22e372f4ac3eb287037a488c29691d52a6330)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.14`	affected	generic	—
`[0,6.14)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that contains the nfsd4_sequence and free_session_slots fix.
If a kernel upgrade is not possible immediately, disable NFSv4 or restrict the NFSv4 service to trusted hosts with firewall rules or export options.
Enable SELinux or AppArmor for the NFS daemon and monitor system logs for kernel Oops or memory corruption events.

Generated by OpenCVE AI on September 15, 2026 at 20:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00649.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/72d40b103bb03f0124d3a3c8f71a30cbafaf6afa
https://git.kernel.org/stable/c/b449b134e7762ddf98653a4b1d3e76d2d212ea64
https://git.kernel.org/stable/c/f5d22e372f4ac3eb287037a488c29691d52a6330
https://nvd.nist.gov/vuln/detail/CVE-2026-89689
https://www.cve.org/CVERecord?id=CVE-2026-89689

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89689 https://www.cve.org/CVERecord?id=CVE-2026-89689
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Important`

Sat, 12 Sep 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() can free the very slot it is currently processing. When the session shrinker has reduced se_target_maxslots below se_fchannel.maxreqs, the shrink path checks three conditions before calling free_session_slots(): 1. se_target_maxslots < maxreqs (shrink was advertised) 2. slot->sl_generation == se_slot_gen (slot is up-to-date) 3. seq->maxslots <= se_target_maxslots (client acknowledges) However, seq->slotid is never checked against se_target_maxslots. A client using a slot in the range [se_target_maxslots, maxreqs) can satisfy all three conditions: its slot has the current generation (set by a prior SEQUENCE), and it sends sa_highest_slotid <= se_target_maxslots to acknowledge the reduction. free_session_slots() then kfrees every slot at index >= se_target_maxslots, including the caller's own slot. The function continues to write sl_seqid, sl_flags, sl_generation, and stores the dangling pointer in cstate->slot. Later, nfsd4_store_cache_entry() copies up to maxresp_cached bytes of the compound reply into the freed sl_data[] array, corrupting whatever slab object now occupies that address. Additionally, a concurrent thread processing SEQUENCE on a different high-numbered slot can have its slot freed out from under it. NFSD4_SLOT_INUSE is set under nn->client_lock before the lock is released, so any concurrent thread past SEQUENCE will have its slot marked. However, free_session_slots() does not check NFSD4_SLOT_INUSE before freeing. Fix both problems by: 1. Checking that the current request's slotid is below the shrink boundary. 2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and deferring the shrink if any are active.
Title		nfsd: don't free session slots that are still in use
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/72d40b103bb03f0124d3a3c8f71a30cbafaf6afa https://git.kernel.org/stable/c/b449b134e7762ddf98653a4b1d3e76d2d212ea64 https://git.kernel.org/stable/c/f5d22e372f4ac3eb287037a488c29691d52a6330

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:09.976Z

Updated: 2026-09-13T06:33:13.546Z

Reserved: 2026-09-11T19:38:34.749Z

Link: CVE-2026-89689

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:55.900

Modified: 2026-09-13T07:17:34.723

Link: CVE-2026-89689

Redhat

Severity : Important

Publid Date: 2026-09-11T19:46:09Z

Links: CVE-2026-89689 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:30:10Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object