CVE-2026-89708 - Vulnerability Details

- nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

After a DESTROY_SESSION the per-session teardown path can free a
session while rpciod still holds an inflight callback rpc_task that
dereferences clp->cl_cb_session. nfsd4_probe_callback_sync() flushes
cl_callback_wq, but once nfsd4_run_cb_work() has called
rpc_call_async() the rpc_task lives on rpciod; flushing the workqueue
does not wait for it. rpc_shutdown_client() does drain rpciod tasks,
but uses a 1-second wait_event_timeout — tasks stuck in rpc_delay()
(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.

destroy path rpciod
------------ ------
unhash_session(ses)
nfsd4_probe_callback_sync(clp)
flush_workqueue(cl_callback_wq)
/* returns; rpc_task still live */
nfsd4_put_session_locked(ses)
free_session(ses) -> kfree(ses)
nfsd4_cb_sequence_done()
reads cb_clp->cl_cb_session
/* freed slab */

A second window exists in nfsd4_process_cb_update(). When
__nfsd4_find_backchannel() returns NULL because unhash_session() has
already removed the destroyed session from cl_sessions,
setup_callback_client() takes the v4.1 early return so
clp->cl_cb_session = ses never fires and the field retains a pointer
to the about-to-be-freed session.

Fix both by converting cl_cb_session to an RCU-protected pointer:

- Move the cl_cb_session = ses assignment in setup_callback_client()
to after rpc_create() succeeds, so it is only published when a
working backchannel exists. Clear cl_cb_session on the error
return in nfsd4_process_cb_update(). Both stores use
rcu_assign_pointer().

- Annotate cl_cb_session with __rcu. All rpciod-side readers use
rcu_read_lock()/rcu_dereference() and check for NULL, bailing to
the appropriate error or requeue path:
encode_cb_sequence4args(), decode_cb_sequence4resok(),
nfsd41_cb_get_slot(), nfsd41_cb_release_slot(),
nfsd4_cb_prepare(), and nfsd4_cb_sequence_done().

- Switch __free_session() from kfree() to kfree_rcu() so the
session slab is not reclaimed until after an RCU grace period,
guaranteeing that rpciod readers inside rcu_read_lock() never
dereference freed memory.

- Pass the session pointer to the nfsd_cb_seq_status and
nfsd_cb_free_slot tracepoints instead of having them re-read
cl_cb_session.

- nfsd4_cb_prepare() calls rpc_exit() when the session is NULL,
routing through the done/release path to requeue the callback.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free flaw in the Linux NFS During a DESTROY_SESSION request, the kernel may free a session while an in‑flight rpciod callback still references cl_cb_session. The freed memory can then be dereferenced, leading to kernel memory corruption. This flaw allows arbitrary kernel memory writes, which could be leveraged to execute code, although this outcome is inferred from the nature of the use‑after‑free rather than explicitly documented.

Affected Systems

All Linux kernel releases that ship the NFSv4 server component are affected until a patch that RCU‑protects cl_cb_session is applied. The advisory does not list specific versions, so any kernel lacking the commit that implements the RCU guard is vulnerable. Downstream distributions should upgrade to the latest kernel that includes the fix or disable the NFSv4 server component if an upgrade is not immediately possible.

Risk and Exploitability

The CVSS score of 9.8 indicates a very high severity, while the EPSS score of < 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, is a remote NFSv4 client that sends a DESTROY_SESSION request to trigger the race condition. Local or remote exploitation would require the attacker to control or influence the timing of the session teardown, a detail not explicitly verified in the advisory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dcbeaa68dbbdacbbb330a86c7fc95a28473fc209`	affected	< 2775ec1d617e665eab71ce0f13ab1f7959713a2b
`dcbeaa68dbbdacbbb330a86c7fc95a28473fc209`	affected	< f164eb52b6f3cbf40f07fe379f9f421f88e02f76
`dcbeaa68dbbdacbbb330a86c7fc95a28473fc209`	affected	< 13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25
`dcbeaa68dbbdacbbb330a86c7fc95a28473fc209`	affected	< 01c5d5f58a5db9b0ee5afba2e49d3157788687b2

Linux

affected

Version	Status	Constraints
`2.6.38`	affected	—
`0`	unaffected	< 2.6.38
`6.12.111`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[dcbeaa68dbbdacbbb330a86c7fc95a28473fc209,f164eb52b6f3cbf40f07fe379f9f421f88e02f76)`	affected	code_commit	—
`[dcbeaa68dbbdacbbb330a86c7fc95a28473fc209,13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25)`	affected	code_commit	—
`[dcbeaa68dbbdacbbb330a86c7fc95a28473fc209,01c5d5f58a5db9b0ee5afba2e49d3157788687b2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.38`	affected	semver	—
`[0,2.6.38)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains the RCU protection commit or backport the fix from the mainline source.
If an upgrade is not feasible immediately, disable or stop the NFSv4 server (nfsd4) to eliminate the vulnerable path.
Monitor system logs for NFS‑related errors or abnormal callback activity that could indicate exploitation attempts and apply subsequent updates promptly.

Generated by OpenCVE AI on September 15, 2026 at 19:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00652.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2
https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25
https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b
https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76
https://nvd.nist.gov/vuln/detail/CVE-2026-89708
https://www.cve.org/CVERecord?id=CVE-2026-89708

History

Mon, 21 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89708 https://www.cve.org/CVERecord?id=CVE-2026-89708
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sat, 12 Sep 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpc_task that dereferences clp->cl_cb_session. nfsd4_probe_callback_sync() flushes cl_callback_wq, but once nfsd4_run_cb_work() has called rpc_call_async() the rpc_task lives on rpciod; flushing the workqueue does not wait for it. rpc_shutdown_client() does drain rpciod tasks, but uses a 1-second wait_event_timeout — tasks stuck in rpc_delay() (e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain. destroy path rpciod ------------ ------ unhash_session(ses) nfsd4_probe_callback_sync(clp) flush_workqueue(cl_callback_wq) /* returns; rpc_task still live / nfsd4_put_session_locked(ses) free_session(ses) -> kfree(ses) nfsd4_cb_sequence_done() reads cb_clp->cl_cb_session / freed slab */ A second window exists in nfsd4_process_cb_update(). When __nfsd4_find_backchannel() returns NULL because unhash_session() has already removed the destroyed session from cl_sessions, setup_callback_client() takes the v4.1 early return so clp->cl_cb_session = ses never fires and the field retains a pointer to the about-to-be-freed session. Fix both by converting cl_cb_session to an RCU-protected pointer: - Move the cl_cb_session = ses assignment in setup_callback_client() to after rpc_create() succeeds, so it is only published when a working backchannel exists. Clear cl_cb_session on the error return in nfsd4_process_cb_update(). Both stores use rcu_assign_pointer(). - Annotate cl_cb_session with __rcu. All rpciod-side readers use rcu_read_lock()/rcu_dereference() and check for NULL, bailing to the appropriate error or requeue path: encode_cb_sequence4args(), decode_cb_sequence4resok(), nfsd41_cb_get_slot(), nfsd41_cb_release_slot(), nfsd4_cb_prepare(), and nfsd4_cb_sequence_done(). - Switch __free_session() from kfree() to kfree_rcu() so the session slab is not reclaimed until after an RCU grace period, guaranteeing that rpciod readers inside rcu_read_lock() never dereference freed memory. - Pass the session pointer to the nfsd_cb_seq_status and nfsd_cb_free_slot tracepoints instead of having them re-read cl_cb_session. - nfsd4_cb_prepare() calls rpc_exit() when the session is NULL, routing through the done/release path to requeue the callback.
Title		nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2 https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25 https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:24.061Z

Updated: 2026-09-21T13:14:51.702Z

Reserved: 2026-09-11T19:38:34.751Z

Link: CVE-2026-89708

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:58.140

Modified: 2026-09-21T14:17:25.690

Link: CVE-2026-89708

Redhat

Severity : Important

Publid Date: 2026-09-11T19:46:24Z

Links: CVE-2026-89708 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T19:45:07Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object