CVE-2026-89670

In the Linux kernel, the following vulnerability has been resolved:

nfsd: hold rcu across localio cmpxchg retry

nfsd file objects are freed via call rcu (filecache.c:296), and nfsd file slab is created without SLAB TYPESAFE BY RCU (KMEM CACHE(nfsd file, 0) at filecache.c:789), so the slab page backing a freed nfsd file becomes freely reclaimable once the RCU grace period elapses.

The again: retry block in nfsd open local fh() loads a pointer with cmpxchg and then calls nfsd file get(new) (which is refcount inc not zero) without holding rcu read lock. The sole caller nfs open local fh() drops rcu read lock before invoking this helper, so no outer reader-side critical section covers the load.

CPU 0 (nfsd open local fh) CPU 1 (nfsd file put local)

new = cmpxchg(pnf, NULL, ...) nf = xchg(pnf, NULL) nfsd file put(nf) last ref -> call rcu() /* grace period elapses; slab page recycled / nfsd file get(new) refcount inc not zero(&new->nf ref) / operates on recycled memory */

A non-zero word at the nf ref offset of the recycled object makes the refcount bump appear to succeed, and the caller then dereferences new->nf net and new->nf file out of freed memory.

Fix by taking rcu read lock() immediately before the cmpxchg and releasing it on all three exits of the if (new) block: the goto-again retry, the lost-race cleanup path, and the install-succeeded path. nfsd file put() and nfsd net put() stay outside the RCU section so they remain free to block.