CVE-2026-89709

In the Linux kernel, the following vulnerability has been resolved:

lockd, nfsd: RCU-protect nlmsvc ops dispatch

nlmsvc ops is published by nfsd lockd init() and cleared by nfsd lockd shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free.

Declare nlmsvc ops as rcu, publish via rcu assign pointer(), clear via RCU INIT POINTER() + synchronize rcu(). Add a struct module *owner field to nlmsvc binding and pin the module across indirect calls with try module get/module put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.