CVE-2026-89682

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89682", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.748Z", "datePublished": "2026-09-11T19:46:04.882Z", "dateUpdated": "2026-10-30T12:32:40.915Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:32:40.915Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue, preventing the shrinker and GC worker from\nbearing the cost of closing files (see ffb402596147). However, the\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\nThe global shrinker, laundrette, and fsnotify callbacks can still be\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\ncausing a use-after-free.\n\nInline the spinlock and freeme list directly into struct nfsd_net (as\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\nallocated struct nfsd_fcache_disposal entirely. These fields now have\nthe same lifetime as the net namespace itself, so there is no dangling\npointer to chase.\n\nnfsd_file_cache_start_net() now just initializes the inline fields and\ncannot fail due to allocation. nfsd_file_cache_shutdown_net() drains\nthe inline list directly instead of freeing a separate struct. The\nalloc/free helpers are removed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - nfsd_file_dispose_list_delayed() runs in the in-kernel NFS server filecache on nfsd_files cached from remote OPEN/READ/WRITE over TCP/UDP 2049; a network NFS client populates that cache and can drive delayed dispose via the global GC laundrette, shrinker, or fsnotify from REMOVE, matching kernel guidance that nfsd is Network.\nAC:H - The UAF requires nfsd_free_fcache_disposal_net() to kfree the separately allocated per-net nfsd_fcache_disposal during nfsd_file_cache_shutdown_net() while the global shrinker, laundrette, or fsnotify still dereference it\u2014a victim-side nfsd restart, shutdown, or netns teardown the remote attacker cannot cause, only race against.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with IP-based exports, so a remote peer that can reach the export self-asserts credentials with no cryptographic authentication and can OPEN/READ files into the filecache; no local Linux account or capability is required.\nUI:N - The attacker issues NFS operations that populate and reclaim the filecache themselves; nfsd per-net teardown is an environmental race counted under Attack Complexity, not an interactive victim action such as mounting a filesystem or opening a file.\nS:U - The use-after-free corrupts host-kernel slab (struct nfsd_fcache_disposal) within the same OS security authority as nfsd and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a slab use-after-free of the kmalloc'd nfsd_fcache_disposal object; reclaim or spray of the freed object lets dispose_list_delayed read attacker-controlled lock and list_head fields, enabling arbitrary kernel disclosure per UAF guidance.\nI:H - spin_lock and list_move_tail on the freed disposal object write into reclaimed slab, corrupting list nodes and lock state and yielding a groomable write or control-flow hijack primitive characteristic of exploitable kernel UAFs.\nA:H - Use-after-free of the disposal spinlock and list from shrinker, GC worker, or fsnotify context causes kernel oops, panic, or list-corruption hangs, fully disrupting availability of the NFS server host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/filecache.c", "fs/nfsd/netns.h"], "versions": [{"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "41fe0e804bbf1110c0aba2ebdfc729efb240d8a6", "status": "affected", "versionType": "git"}, {"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "e6c3a43d0a41f03abae3764fc82a59369360c7e0", "status": "affected", "versionType": "git"}, {"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67", "status": "affected", "versionType": "git"}, {"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "ba0ee9e04b7a0356c28d5a2fe445db675d24e572", "status": "affected", "versionType": "git"}, {"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "cadc9036d5a8209f89e7026ddba7cfb1c716b03c", "status": "affected", "versionType": "git"}, {"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4", "status": "affected", "versionType": "git"}, {"version": "e8f923e1e9fcc0832a12c8a2461792e5a9544c03", "status": "affected", "versionType": "git"}, {"version": "3bc94fb44f10ef852723e1aeaac6794c5ab16aec", "status": "affected", "versionType": "git"}, {"version": "5.10.220", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.154", "lessThan": "5.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/filecache.c", "fs/nfsd/netns.h"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.220"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.154"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/41fe0e804bbf1110c0aba2ebdfc729efb240d8a6"}, {"url": "https://git.kernel.org/stable/c/e6c3a43d0a41f03abae3764fc82a59369360c7e0"}, {"url": "https://git.kernel.org/stable/c/9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67"}, {"url": "https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572"}, {"url": "https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"}, {"url": "https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4"}], "title": "nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/filecache.c", "fs/nfsd/netns.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "41fe0e804bbf1110c0aba2ebdfc729efb240d8a6", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"lessThan": "e6c3a43d0a41f03abae3764fc82a59369360c7e0", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"lessThan": "9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"lessThan": "ba0ee9e04b7a0356c28d5a2fe445db675d24e572", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"lessThan": "cadc9036d5a8209f89e7026ddba7cfb1c716b03c", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"lessThan": "bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"status": "affected", "version": "e8f923e1e9fcc0832a12c8a2461792e5a9544c03", "versionType": "git"}, {"status": "affected", "version": "3bc94fb44f10ef852723e1aeaac6794c5ab16aec", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.220", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.154", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/filecache.c", "fs/nfsd/netns.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue, preventing the shrinker and GC worker from\nbearing the cost of closing files (see ffb402596147). However, the\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\nThe global shrinker, laundrette, and fsnotify callbacks can still be\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\ncausing a use-after-free.\n\nInline the spinlock and freeme list directly into struct nfsd_net (as\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\nallocated struct nfsd_fcache_disposal entirely. These fields now have\nthe same lifetime as the net namespace itself, so there is no dangling\npointer to chase.\n\nnfsd_file_cache_start_net() now just initializes the inline fields and\ncannot fail due to allocation. nfsd_file_cache_shutdown_net() drains\nthe inline list directly instead of freeing a separate struct. The\nalloc/free helpers are removed."}], "id": "CVE-2026-89682", "lastModified": "2026-10-30T13:20:26.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:55.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41fe0e804bbf1110c0aba2ebdfc729efb240d8a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6c3a43d0a41f03abae3764fc82a59369360c7e0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Kernel: NFS daemon (nfsd) use-after-free vulnerability in file cache disposal", "id": "2532019", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532019"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's NFS daemon (nfsd) component. The nfsd_file_dispose_list_delayed() function, responsible for deferring file disposal, uses a separately allocated structure for its freeme queue. During network namespace teardown, this structure can be prematurely freed. This allows other kernel callbacks to attempt to dereference the freed memory, leading to a use-after-free (UAF) vulnerability. A local attacker could potentially exploit this to cause a system crash or escalate privileges."], "name": "CVE-2026-89682", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:46:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89682\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89682\nhttps://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572\nhttps://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4\nhttps://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1463b38e7cf34d4cc60f41daff459ad807b2e408,ba0ee9e04b7a0356c28d5a2fe445db675d24e572)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1463b38e7cf34d4cc60f41daff459ad807b2e408,cadc9036d5a8209f89e7026ddba7cfb1c716b03c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1463b38e7cf34d4cc60f41daff459ad807b2e408,bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e8f923e1e9fcc0832a12c8a2461792e5a9544c03"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3bc94fb44f10ef852723e1aeaac6794c5ab16aec"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.220,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.154,5.16)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.51,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T06:30:09.004453+00:00", "updated": "2026-09-15T20:30:10.333921+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}