CVE-2026-89670

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: hold rcu across localio cmpxchg retry

nfsd_file objects are freed via call_rcu (filecache.c:296), and

nfsd_file_slab is created without SLAB_TYPESAFE_BY_RCU

(KMEM_CACHE(nfsd_file, 0) at filecache.c:789), so the slab page

backing a freed nfsd_file becomes freely reclaimable once the RCU

grace period elapses.

The again: retry block in nfsd_open_local_fh() loads a pointer with

cmpxchg and then calls nfsd_file_get(new) (which is

refcount_inc_not_zero) without holding rcu_read_lock. The sole caller

nfs_open_local_fh() drops rcu_read_lock before invoking this helper,

so no outer reader-side critical section covers the load.

CPU 0 (nfsd_open_local_fh) CPU 1 (nfsd_file_put_local)

----- -----

new = cmpxchg(pnf, NULL, ...)

nf = xchg(pnf, NULL)

nfsd_file_put(nf)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References