CVE-2026-89661

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel's NFSD component. A local administrator with CAP SYS ADMIN privileges can trigger this by stopping the server and writing a filesystem path to the /proc/fs/nfsd/unlock filesystem endpoint. The issue occurs because the nfsd4 cancel copy by sb() function is executed before the nfsd mutex is held and before verifying if nn->nfsd serv is set. After the server shuts down, nfs4 state destroy net() frees nn->conf id hashtbl but leaves the pointer intact, causing the cancel helper to iterate through freed slab memory and dereference an invalid nfs4 client when accessing clp->async lock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.