Cloudanix VulnDB

CVE-2026-89661

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux NFS server lets a highly privileged local user crash the system or possibly run code by writing to a control file after the server has already been stopped.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free read in nfsd4_cancel_copy_by_sb() that dereferences a freed nfs4_client structure from nn->conf_id_hashtbl after nfs4_state_destroy_net() has run but left the pointer intact; occurs when a CAP_SYS_ADMIN user writes to /proc/fs/nfsd/unlock_filesystem after nfsd shutdown without holding nfsd_mutex or confirming nn->nfsd_serv is present.

Why it matters to the business

Local administrator on an NFS server host can trigger kernel memory corruption, leading to crashes, information leaks, or potential privilege escalation; limited to systems exposing the nfsd proc interface and requiring deliberate server shutdown first.

How an attack unfolds

A local user with CAP_SYS_ADMIN stops the nfsd service, then writes a filesystem path to /proc/fs/nfsd/unlock_filesystem; this invokes nfsd4_cancel_copy_by_sb() which walks the already-freed conf_id_hashtbl, dereferences bogus list_head entries, and accesses clp->async_lock on a freed nfs4_client, reported by KASAN as slab-use-after-free.

How to fix it

Apply the upstream fix that relocates the async COPY cancel into the nfsd_mutex-protected section that first confirms nn->nfsd_serv is non-NULL; rebuild and deploy the patched kernel on all affected Linux systems running nfsd.

How to confirm the fix worked

Confirm the patched kernel source contains the mutex-protected check around nfsd4_cancel_copy_by_sb() before the state-table walk; verify runtime behavior no longer produces KASAN slab-use-after-free reports when the unlock_filesystem write occurs after shutdown.

Typical attack path

  1. Obtain CAP_SYS_ADMIN on the target host
  2. Stop the running nfsd service
  3. Write a path string to /proc/fs/nfsd/unlock_filesystem
  4. Trigger nfsd4_cancel_copy_by_sb() on freed slab memory

How to detect it

Search kernel logs for KASAN slab-use-after-free reports naming nfsd4_cancel_copy_by_sb or nfs4_state_destroy_net; audit process activity that writes to /proc/fs/nfsd/unlock_filesystem immediately after nfsd shutdown events.

  • /proc/fs/nfsd/unlock_filesystem
  • nfsd4_cancel_copy_by_sb
  • slab-use-after-free read in nfsd4_cancel_copy_by_sb
  • nfs4_state_destroy_net

What your security team should do

  • Prioritize kernel updates on all hosts running the Linux NFS server
  • Restrict CAP_SYS_ADMIN to the minimum necessary accounts and monitor its use
  • Disable nfsd if the service is not required
  • Add monitoring for writes to /proc/fs/nfsd/unlock_filesystem outside normal startup windows

The record

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the handler confirms that nn->nfsd_serv is set. Once nfsd has shut down, nfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the pointer intact, so the cancel helper iterates freed slab memory as an array of struct list_head and then dereferences a bogus nfs4_client when it takes clp->async_lock. A local administrator holding CAP_SYS_ADMIN can reach this use-after-free by stopping the server and then writing to unlock_filesystem; KASAN reports a slab-use-after-free read in nfsd4_cancel_copy_by_sb(). nfsd4_revoke_states() walks the same state tables and for that reason already runs only under nfsd_mutex with nn->nfsd_serv confirmed present. Move the async COPY cancel into that protected section so every NFSv4 state-table walker on this path observes a running server. Async copies exist only while the server runs, so gating the cancel on nn->nfsd_serv loses nothing.

Affected packages

Ecosystem Package Introduced Fixed