Cloudanix VulnDB

CVE-2026-89662

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux file-sharing service can let remote attackers crash the server or take over the machine.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in NFSD client teardown where __destroy_client() dereferences a lock owner after the laundromat path frees it via blocked_locks_lru, resulting in NULL dereference in remove_blocked_locks().

Why it matters to the business

Remote attackers can crash NFS servers or potentially execute arbitrary code in the kernel, causing denial of service for file-sharing services and risking full system compromise on exposed Linux hosts.

How an attack unfolds

An attacker sends NFSv4 DESTROY_CLIENTID or related lock operations to trigger client teardown while a blocked lock owner remains referenced only by the laundromat; concurrent timing allows the laundromat to free the owner, leading to use-after-free when __destroy_client() walks the hash table.

How to fix it

Apply the upstream fix that holds cl_lock across the owner walk, takes references, and unhooks owners before calling remove_blocked_locks(). Update to a kernel containing the resolution for this NFSD use-after-free.

How to confirm the fix worked

Confirm the patch is present by inspecting nfsd source for cl_lock protection around owner unhashing in __destroy_client(); test NFSv4 client teardown under load with blocked locks.

Typical attack path

  1. Establish NFSv4 client connection and acquire blocked locks
  2. Trigger client teardown via DESTROY_CLIENTID while laundromat is active
  3. Race the per-net laundromat reaping against __destroy_client() walk
  4. Cause NULL dereference or memory corruption during owner dereference

How to detect it

Inspect kernel logs for oops or NULL dereference in remove_blocked_locks or nfsd client teardown paths; correlate with NFSv4 DESTROY_CLIENTID traffic and laundromat activity.

What your security team should do

  • Prioritize patching Linux kernels running nfsd on any externally reachable interface
  • Disable NFSv4 or restrict to trusted networks until patched
  • Monitor for kernel oops or crashes in nfsd4_release_lockowner paths

The record

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present. __destroy_client() then walks the table, calling remove_blocked_locks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flc_owner. The per-net laundromat reaps blocked locks from nn->blocked_locks_lru independently of client state. The two paths share blocked_locks_lock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as __destroy_client() dereferences it, a NULL dereference in remove_blocked_locks(). nfsd4_release_lockowner() holds a reference across the same call; __destroy_client() does not. Hold cl_lock across the walk, taking a reference and unhashing each owner, then drop it before remove_blocked_locks() and nfs4_put_stateowner(), which take blocked_locks_lock and cl_lock.

Affected packages

Ecosystem Package Introduced Fixed