CVE-2026-89668

In the Linux kernel, the following vulnerability has been resolved:

nfsd: move nfsd debugfs init() after nfsd4 init slabs() in init nfsd()

nfsd debugfs init() runs before nfsd4 init slabs() in init nfsd(). If the slab allocation fails, the bare "return retval" bypasses nfsd debugfs exit(), leaving orphan debugfs files with stale fops pointers into the freed module text.

Move nfsd debugfs init() to after the slab init succeeds, so the early return has no debugfs state to clean up.

Since debugfs is now the more recently initialized of the two, also update the unwind paths to match reverse-initialization (LIFO) order: run nfsd debugfs exit() before nfsd4 free slabs() in both the init nfsd() error path and exit nfsd(). The nfsd debugfs files only reference module-global state and have no dependency on the slab caches, so that reordering is a cleanup with no functional change.