CVE-2026-89689

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: don't free session slots that are still in use

nfsd4_sequence() can free the very slot it is currently processing.

When the session shrinker has reduced se_target_maxslots below

se_fchannel.maxreqs, the shrink path checks three conditions before

calling free_session_slots():

1. se_target_maxslots < maxreqs (shrink was advertised)

2. slot->sl_generation == se_slot_gen (slot is up-to-date)

3. seq->maxslots <= se_target_maxslots (client acknowledges)

However, seq->slotid is never checked against se_target_maxslots.

A client using a slot in the range [se_target_maxslots, maxreqs) can

satisfy all three conditions: its slot has the current generation

(set by a prior SEQUENCE), and it sends sa_highest_slotid <=

se_target_maxslots to acknowledge the reduction.

free_session_slots() then kfrees every slot at index >=

se_target_maxslots, including the caller's own slot. The function

continues to write sl_seqid

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References