CVE-2026-89708

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

After a DESTROY_SESSION the per-session teardown path can free a

session while rpciod still holds an inflight callback rpc_task that

dereferences clp->cl_cb_session. nfsd4_probe_callback_sync() flushes

cl_callback_wq, but once nfsd4_run_cb_work() has called

rpc_call_async() the rpc_task lives on rpciod; flushing the workqueue

does not wait for it. rpc_shutdown_client() does drain rpciod tasks,

but uses a 1-second wait_event_timeout — tasks stuck in rpc_delay()

(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.

destroy path rpciod

------------ ------

unhash_session(ses)

nfsd4_probe_callback_sync(clp)

flush_workqueue(cl_callback_wq)

/* returns; rpc_task still live */

nfsd4_put_session_locked(ses)

free_session(ses) -> kfree(ses)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References