{"id":"CVE-2026-89661","state":"PUBLISHED","title":"NFSD: Prevent post-shutdown use-after-free in unlock_filesystem","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent post-shutdown use-after-free in unlock_filesystem\n\nWriting a filesystem path to /proc/fs/nfsd/unlock_filesystem runs\nnfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the\nhandler confirms that nn->nfsd_serv is set. Once nfsd has shut down,\nnfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the\npointer intact, so the cancel helper iterates freed slab memory as an\narray of struct list_head and then dereferences a bogus nfs4_client\nwhen it takes clp->async_lock. A local administrator holding\nCAP_SYS_ADMIN can reach this use-after-free by stopping the server and\nthen writing to unlock_filesystem; KASAN reports a slab-use-after-free\nread in nfsd4_cancel_copy_by_sb().\n\nnfsd4_revoke_states() walks the same state tables and for that reason\nalready runs only under nfsd_mutex with nn->nfsd_serv confirmed\npresent. Move the async COPY cancel into that protected section so\nevery NFSv4 state-table walker on this path observes a running server.\nAsync copies exist only while the server runs, so gating the cancel on\nnn->nfsd_serv loses nothing.","publishedAt":"2026-09-11T19:45:49.086Z","updatedAt":"2026-10-19T08:50:32.806Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3daab3112f039cf849f96764019b096bb0a39d04","status":"affected","lessThan":"0c1a755b7212e0835398d4df5e782ea85ccd7476","versionType":"git"},{"version":"3daab3112f039cf849f96764019b096bb0a39d04","status":"affected","lessThan":"292d915d3ba6fd15eeb88351fa10581683073109","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfsctl.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.0","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfsctl.c"]}],"references":["https://git.kernel.org/stable/c/0c1a755b7212e0835398d4df5e782ea85ccd7476","https://git.kernel.org/stable/c/292d915d3ba6fd15eeb88351fa10581683073109"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89661.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89661","state":"PUBLISHED","datePublished":"2026-09-11T19:45:49.086Z","dateUpdated":"2026-10-19T08:50:32.806Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.744Z"},"containers":{"cna":{"title":"NFSD: Prevent post-shutdown use-after-free in unlock_filesystem","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent post-shutdown use-after-free in unlock_filesystem\n\nWriting a filesystem path to /proc/fs/nfsd/unlock_filesystem runs\nnfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the\nhandler confirms that nn->nfsd_serv is set. Once nfsd has shut down,\nnfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the\npointer intact, so the cancel helper iterates freed slab memory as an\narray of struct list_head and then dereferences a bogus nfs4_client\nwhen it takes clp->async_lock. A local administrator holding\nCAP_SYS_ADMIN can reach this use-after-free by stopping the server and\nthen writing to unlock_filesystem; KASAN reports a slab-use-after-free\nread in nfsd4_cancel_copy_by_sb().\n\nnfsd4_revoke_states() walks the same state tables and for that reason\nalready runs only under nfsd_mutex with nn->nfsd_serv confirmed\npresent. Move the async COPY cancel into that protected section so\nevery NFSv4 state-table walker on this path observes a running server.\nAsync copies exist only while the server runs, so gating the cancel on\nnn->nfsd_serv loses nothing."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3daab3112f039cf849f96764019b096bb0a39d04","status":"affected","lessThan":"0c1a755b7212e0835398d4df5e782ea85ccd7476","versionType":"git"},{"version":"3daab3112f039cf849f96764019b096bb0a39d04","status":"affected","lessThan":"292d915d3ba6fd15eeb88351fa10581683073109","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfsctl.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.0","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfsctl.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/0c1a755b7212e0835398d4df5e782ea85ccd7476"},{"url":"https://git.kernel.org/stable/c/292d915d3ba6fd15eeb88351fa10581683073109"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:50:32.806Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}