Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-89709

lockd, nfsd: RCU-protect nlmsvc_ops dispatch

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 43943532c105ea8fe26039a1347cfda4ac0fcadcaffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 6e7495972039f212e336e552b58cac9dd54611c3affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 836ce2b99bcce6d68c58edd04efbc5cd1fd581afaffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3c461a1820088fb5889d73a6522369bde45527a9affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 641e5e20852359b8c31149be4598884e30652f60affected

Linux Linux

Default version status: affected

  • 2.6.12affected
  • 0 to < 2.6.12unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.2.4 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References