Cloudanix VulnDB

CVE-2026-89709

High · 8.1

CVSS

8.1

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A synchronization error in the Linux kernel's NFS locking code can let the system crash or become unstable if certain modules are removed while in use.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper RCU synchronization on nlmsvc_ops pointer allows stale reference after nfsd module unload, resulting in NULL dereference or use-after-free of module .text pages during lockd dispatch.

Why it matters to the business

Potential kernel crash or memory corruption on systems running both lockd and nfsd, leading to service disruption and possible local privilege escalation if triggered.

How an attack unfolds

An attacker with network access to NFS services triggers lockd dispatch paths while concurrently unloading the nfsd module, causing the kernel to dereference a freed or invalid nlmsvc_ops binding and execute attacker-controlled or invalid code.

How to fix it

Apply the upstream fix that marks nlmsvc_ops as __rcu, uses rcu_assign_pointer and RCU_INIT_POINTER with synchronize_rcu, and adds module owner pinning via try_module_get/module_put. Rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Confirm the kernel source contains the RCU annotations and owner field on nlmsvc_binding, then verify no plain stores or unguarded loads remain around nfsd_lockd_init/shutdown and lockd dispatch sites.

Typical attack path

  1. Establish NFS/lockd client connections to the target
  2. Trigger repeated lock requests to keep dispatch paths active
  3. Unload or cause unload of the nfsd kernel module
  4. Induce dispatch through the now-stale nlmsvc_ops pointer
  5. Achieve NULL dereference or module-text UAF for denial of service or code execution

How to detect it

Review kernel logs for oops/panic messages referencing nlmsvc_ops, svcsubs.c, or module unload of nfsd; correlate with lockd dispatch activity and unexpected rmmod events.

  • nlmsvc_ops
  • fs/lockd/svcsubs.c
  • nfsd_lockd_init
  • nfsd_lockd_shutdown

What your security team should do

  • Prioritize kernel update on all systems exposing NFS/lockd services
  • Disable nfsd or lockd where not required to reduce attack surface
  • Monitor for module unload events coinciding with lockd activity

The record

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.

Affected packages

Ecosystem Package Introduced Fixed