CVE-2026-89661

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent post-shutdown use-after-free in unlock_filesystem

Writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs

nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the

handler confirms that nn->nfsd_serv is set. Once nfsd has shut down,

nfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the

pointer intact, so the cancel helper iterates freed slab memory as an

array of struct list_head and then dereferences a bogus nfs4_client

when it takes clp->async_lock. A local administrator holding

CAP_SYS_ADMIN can reach this use-after-free by stopping the server and

then writing to unlock_filesystem; KASAN reports a slab-use-after-free

read in nfsd4_cancel_copy_by_sb().

nfsd4_revoke_states() walks the same state tables and for that reason

already runs only under nfsd_mutex with nn->nfsd_serv confirmed

present. Move the async COPY cancel into that protected section so

every NFSv4 state-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References