CVE-2026-89667

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

The shrinker, GC worker, and fsnotify/lease callbacks can unhash an

nfsd_file from the rhashtable and then call

nfsd_file_dispose_list_delayed() to move it to the per-net dispose list.

If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk

misses the already-unhashed file, and its drain of the per-net dispose

list can run before the file has been queued. The file then sits on

the per-net list with no thread to drain it, leaking both the file and

its associated state.

The GC worker and shrinker already hold nfsd_gc_lock while walking the

LRU, but in the original code they release it before calling

nfsd_file_dispose_list_delayed(). The fsnotify/lease path

(nfsd_file_close_inode) has no synchronization at all.

Fix this by:

1. Widening nfsd_gc_lock in both nfsd_file_gc() and nfsd_file_lru_scan()

to cover the nfsd_file_dis

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References