CVE-2026-89682

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads

via a per-net freeme queue, preventing the shrinker and GC worker from

bearing the cost of closing files (see ffb402596147). However, the

queue lives in a separately-allocated struct nfsd_fcache_disposal that

is freed by nfsd_free_fcache_disposal_net() during per-net teardown.

The global shrinker, laundrette, and fsnotify callbacks can still be

inside nfsd_file_dispose_list_delayed() dereferencing that pointer,

causing a use-after-free.

Inline the spinlock and freeme list directly into struct nfsd_net (as

fcache_dispose_lock and fcache_dispose_list), eliminating the separately

allocated struct nfsd_fcache_disposal entirely. These fields now have

the same lifetime as the net namespace itself, so there is no dangling

pointer to chase.

nfsd_file_cache_start_net() now just initi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References