CVE-2026-89682
High · 8.1CVSS
8.1
EPSS
0.6%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A flaw in the Linux NFS server code can let attackers corrupt memory or crash the system by exploiting timing between file cleanup and network shutdown.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- High
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in nfsd_file_dispose_list_delayed where the global shrinker, laundrette, and fsnotify callbacks dereference a pointer into a separately-allocated nfsd_fcache_disposal struct that has already been freed during per-net teardown.
Why it matters to the business
Remote attackers can trigger kernel memory corruption or crashes on systems exposing NFS services, leading to denial of service or potential privilege escalation affecting file-sharing workloads.
How an attack unfolds
An attacker issues NFS operations that populate the per-net freeme queue; during namespace teardown the disposal struct is freed while asynchronous shrinker or fsnotify paths still hold references, resulting in a use-after-free that can be leveraged for memory corruption.
How to fix it
Apply the upstream kernel commit that inlines fcache_dispose_lock and fcache_dispose_list directly into struct nfsd_net, removing the separate nfsd_fcache_disposal allocation entirely; rebuild and reboot with the patched kernel.
How to confirm the fix worked
Confirm the presence of fcache_dispose_lock and fcache_dispose_list fields inside struct nfsd_net in the kernel source and verify that nfsd_file_cache_start_net no longer performs a separate allocation for disposal state.
Typical attack path
- Establish NFS mounts or issue file operations that enqueue deferred fput work on the per-net disposal queue
- Trigger net namespace teardown or concurrent shrinker/GC activity while the disposal struct is still referenced
- Force the freed struct to be dereferenced by the laundrette or fsnotify callbacks
- Exploit the resulting use-after-free for memory corruption or control-flow hijacking
How to detect it
Search kernel logs and vmcore for use-after-free or slab corruption reports referencing nfsd_file_dispose_list_delayed, fcache_disposal, or nfsd_net during namespace teardown; inspect audit logs for unusual NFS client activity coinciding with crashes.
What your security team should do
- Prioritize patching all NFS server kernels within the next maintenance window
- Monitor for kernel oops or slab-use-after-free reports mentioning nfsd_file_dispose_list_delayed
- Temporarily restrict NFS exposure from untrusted networks until patches are deployed
The record
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing files (see ffb402596147). However, the queue lives in a separately-allocated struct nfsd_fcache_disposal that is freed by nfsd_free_fcache_disposal_net() during per-net teardown. The global shrinker, laundrette, and fsnotify callbacks can still be inside nfsd_file_dispose_list_delayed() dereferencing that pointer, causing a use-after-free. Inline the spinlock and freeme list directly into struct nfsd_net (as fcache_dispose_lock and fcache_dispose_list), eliminating the separately allocated struct nfsd_fcache_disposal entirely. These fields now have the same lifetime as the net namespace itself, so there is no dangling pointer to chase. nfsd_file_cache_start_net() now just initializes the inline fields and cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains the inline list directly instead of freeing a separate struct. The alloc/free helpers are removed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|