CVE-2026-89662 (GCVE-0-2026-89662)
Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-10-19 08:50
VLAI
EPSS
VEX
Title
NFSD: Prevent lock owner use-after-free during client teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent lock owner use-after-free during client teardown
__destroy_client() releases a client's open owners, but a lock owner
whose only reference is a blocked lock (nbl) stays on
cl_ownerstr_hashtbl. client_has_state() does not count a bare owner,
so DESTROY_CLIENTID can reach __destroy_client() with such owners
present.
__destroy_client() then walks the table, calling remove_blocked_locks()
on each owner without a reference. Freeing a blocked lock drops the
owner reference held via flc_owner. The per-net laundromat reaps
blocked locks from nn->blocked_locks_lru independently of client state.
The two paths share blocked_locks_lock only for the list splice, not
the owner's lifetime. The laundromat therefore frees the owner as
__destroy_client() dereferences it, a NULL dereference in
remove_blocked_locks().
nfsd4_release_lockowner() holds a reference across the same call;
__destroy_client() does not. Hold cl_lock across the walk, taking a
reference and unhashing each owner, then drop it before
remove_blocked_locks() and nfs4_put_stateowner(), which take
blocked_locks_lock and cl_lock.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:25 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
68ef3bc3166468678d5e1fdd216628c35bd1186f , < 42d7954b0a1907d4ef122aef94561952a033cdc3
(git)
Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a (git) Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < b8bad5a11416b26cc7fd4b18fba46d75ff636558 (git) Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 1ce74d1b7770e69735e8f8e509807af4ff9c8ee7 (git) Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < a6ead6fff3a7d03e49845f048f7000a2e0d34431 (git) Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 4804c58f73a80d12df1de323bf97a164f6ee8743 (git) Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 8cf4ff0a7c083dd5e0067f517d63979b74b66649 (git) Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 5e2fa29d223a9a1e6a948e40b109d09081d1decd (git) Affected: e294c4c2d33b7307a89cdf31bec08a112d6a9297 (git) Affected: 797bfd05d4040fbf766198b3cfcc1838002cc890 (git) Affected: 0f44e9da465ea259b6c9f31a627f3c50a16e1679 (git) Affected: 4.9.91 , < 4.10 (semver) Affected: 4.14.31 , < 4.15 (semver) Affected: 4.15.14 , < 4.16 (semver) |
guessed | |
| Linux | Linux |
Affected:
4.16
Unaffected: 0 , < 4.16 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89662",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:37.406747Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:47.751Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42d7954b0a1907d4ef122aef94561952a033cdc3",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "b8bad5a11416b26cc7fd4b18fba46d75ff636558",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "1ce74d1b7770e69735e8f8e509807af4ff9c8ee7",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "a6ead6fff3a7d03e49845f048f7000a2e0d34431",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "4804c58f73a80d12df1de323bf97a164f6ee8743",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "8cf4ff0a7c083dd5e0067f517d63979b74b66649",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "5e2fa29d223a9a1e6a948e40b109d09081d1decd",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"status": "affected",
"version": "e294c4c2d33b7307a89cdf31bec08a112d6a9297",
"versionType": "git"
},
{
"status": "affected",
"version": "797bfd05d4040fbf766198b3cfcc1838002cc890",
"versionType": "git"
},
{
"status": "affected",
"version": "0f44e9da465ea259b6c9f31a627f3c50a16e1679",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.91",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.31",
"versionType": "semver"
},
{
"lessThan": "4.16",
"status": "affected",
"version": "4.15.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.15.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent lock owner use-after-free during client teardown\n\n__destroy_client() releases a client\u0027s open owners, but a lock owner\nwhose only reference is a blocked lock (nbl) stays on\ncl_ownerstr_hashtbl. client_has_state() does not count a bare owner,\nso DESTROY_CLIENTID can reach __destroy_client() with such owners\npresent.\n\n__destroy_client() then walks the table, calling remove_blocked_locks()\non each owner without a reference. Freeing a blocked lock drops the\nowner reference held via flc_owner. The per-net laundromat reaps\nblocked locks from nn-\u003eblocked_locks_lru independently of client state.\nThe two paths share blocked_locks_lock only for the list splice, not\nthe owner\u0027s lifetime. The laundromat therefore frees the owner as\n__destroy_client() dereferences it, a NULL dereference in\nremove_blocked_locks().\n\nnfsd4_release_lockowner() holds a reference across the same call;\n__destroy_client() does not. Hold cl_lock across the walk, taking a\nreference and unhashing each owner, then drop it before\nremove_blocked_locks() and nfs4_put_stateowner(), which take\nblocked_locks_lock and cl_lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in nfsd NFSv4.1 client teardown and blocked-lock handling, reached by remote COMPOUND RPCs on the in-kernel NFS server (TCP/UDP 2049). A network client drives EXCHANGE_ID, CREATE_SESSION, OPEN, blocking LOCK, DESTROY_SESSION, and DESTROY_CLIENTID into __destroy_client().\nAC:L - The attacker controls both sides of the race: one client holds a conflicting lock while another queues a blocked lock, then DESTROY_CLIENTID races with lock-grant/CB_NOTIFY_LOCK or the laundromat freeing that lockowner. Concurrent NFS requests create the race, and it can be retried.\nPR:N - Typical nfsd deployments use AUTH_SYS, which does not cryptographically authenticate the client. A remote peer that can reach an export can create NFSv4.1 state and issue DESTROY_CLIENTID without a local account or kernel capabilities on the server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export. No victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The use-after-free occurs in kernel nfsd lock-owner state on the NFS server host and does not cross a separate security authority such as a VM, guest/host, or IOMMU boundary.\nC:H - This is a use-after-free of the nfs4_lockowner slab object. Reclaiming the freed owner lets an attacker control later reads of so_client and related pointers in remove_blocked_locks(), yielding a kernel information-disclosure primitive.\nI:H - The same UAF is exploitable for integrity: the freed lockowner includes so_ops function pointers and lo_blocked list heads, so heap reuse can hijack control flow or corrupt list pointers for an arbitrary kernel write.\nA:H - The bug is a kernel use-after-free of the lock owner and was observed as a NULL dereference in remove_blocked_locks(), which can oops or panic nfsd and take down the server."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:50:33.792Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42d7954b0a1907d4ef122aef94561952a033cdc3"
},
{
"url": "https://git.kernel.org/stable/c/bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a"
},
{
"url": "https://git.kernel.org/stable/c/b8bad5a11416b26cc7fd4b18fba46d75ff636558"
},
{
"url": "https://git.kernel.org/stable/c/1ce74d1b7770e69735e8f8e509807af4ff9c8ee7"
},
{
"url": "https://git.kernel.org/stable/c/a6ead6fff3a7d03e49845f048f7000a2e0d34431"
},
{
"url": "https://git.kernel.org/stable/c/4804c58f73a80d12df1de323bf97a164f6ee8743"
},
{
"url": "https://git.kernel.org/stable/c/8cf4ff0a7c083dd5e0067f517d63979b74b66649"
},
{
"url": "https://git.kernel.org/stable/c/5e2fa29d223a9a1e6a948e40b109d09081d1decd"
}
],
"title": "NFSD: Prevent lock owner use-after-free during client teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89662",
"datePublished": "2026-09-11T19:45:49.833Z",
"dateReserved": "2026-09-11T19:38:34.744Z",
"dateUpdated": "2026-10-19T08:50:33.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-89662",
"date": "2026-11-01",
"epss": "0.00694",
"percentile": "0.5295"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:21:41.000Z",
"cve": "CVE-2026-89662",
"id": "msrc_CVE-2026-89662",
"initial_release_date": "2026-09-13T01:01:49.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "NFSD: Prevent lock owner use-after-free during client teardown",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89662.json",
"version": "5"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42d7954b0a1907d4ef122aef94561952a033cdc3",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "b8bad5a11416b26cc7fd4b18fba46d75ff636558",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "1ce74d1b7770e69735e8f8e509807af4ff9c8ee7",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "a6ead6fff3a7d03e49845f048f7000a2e0d34431",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "4804c58f73a80d12df1de323bf97a164f6ee8743",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "8cf4ff0a7c083dd5e0067f517d63979b74b66649",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "5e2fa29d223a9a1e6a948e40b109d09081d1decd",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"status": "affected",
"version": "e294c4c2d33b7307a89cdf31bec08a112d6a9297",
"versionType": "git"
},
{
"status": "affected",
"version": "797bfd05d4040fbf766198b3cfcc1838002cc890",
"versionType": "git"
},
{
"status": "affected",
"version": "0f44e9da465ea259b6c9f31a627f3c50a16e1679",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.91",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.31",
"versionType": "semver"
},
{
"lessThan": "4.16",
"status": "affected",
"version": "4.15.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent lock owner use-after-free during client teardown\n\n__destroy_client() releases a client\u0027s open owners, but a lock owner\nwhose only reference is a blocked lock (nbl) stays on\ncl_ownerstr_hashtbl. client_has_state() does not count a bare owner,\nso DESTROY_CLIENTID can reach __destroy_client() with such owners\npresent.\n\n__destroy_client() then walks the table, calling remove_blocked_locks()\non each owner without a reference. Freeing a blocked lock drops the\nowner reference held via flc_owner. The per-net laundromat reaps\nblocked locks from nn-\u003eblocked_locks_lru independently of client state.\nThe two paths share blocked_locks_lock only for the list splice, not\nthe owner\u0027s lifetime. The laundromat therefore frees the owner as\n__destroy_client() dereferences it, a NULL dereference in\nremove_blocked_locks().\n\nnfsd4_release_lockowner() holds a reference across the same call;\n__destroy_client() does not. Hold cl_lock across the walk, taking a\nreference and unhashing each owner, then drop it before\nremove_blocked_locks() and nfs4_put_stateowner(), which take\nblocked_locks_lock and cl_lock."
}
],
"id": "CVE-2026-89662",
"lastModified": "2026-10-19T09:18:04.083",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-89662",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:37.406747Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-11T20:19:52.523",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1ce74d1b7770e69735e8f8e509807af4ff9c8ee7"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/42d7954b0a1907d4ef122aef94561952a033cdc3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4804c58f73a80d12df1de323bf97a164f6ee8743"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5e2fa29d223a9a1e6a948e40b109d09081d1decd"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/8cf4ff0a7c083dd5e0067f517d63979b74b66649"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a6ead6fff3a7d03e49845f048f7000a2e0d34431"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b8bad5a11416b26cc7fd4b18fba46d75ff636558"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-30T06:27:58+00:00",
"cve": "CVE-2026-89662",
"id": "CVE-2026-89662",
"initial_release_date": "2026-09-11T00:00:00+00:00",
"product_status:known_affected": "279",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: NFSD: Prevent lock owner use-after-free during client teardown",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89662.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89662",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:37.406747Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:25:38.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42d7954b0a1907d4ef122aef94561952a033cdc3",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "b8bad5a11416b26cc7fd4b18fba46d75ff636558",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "1ce74d1b7770e69735e8f8e509807af4ff9c8ee7",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "a6ead6fff3a7d03e49845f048f7000a2e0d34431",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "4804c58f73a80d12df1de323bf97a164f6ee8743",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "8cf4ff0a7c083dd5e0067f517d63979b74b66649",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"lessThan": "5e2fa29d223a9a1e6a948e40b109d09081d1decd",
"status": "affected",
"version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
"versionType": "git"
},
{
"status": "affected",
"version": "e294c4c2d33b7307a89cdf31bec08a112d6a9297",
"versionType": "git"
},
{
"status": "affected",
"version": "797bfd05d4040fbf766198b3cfcc1838002cc890",
"versionType": "git"
},
{
"status": "affected",
"version": "0f44e9da465ea259b6c9f31a627f3c50a16e1679",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.91",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.31",
"versionType": "semver"
},
{
"lessThan": "4.16",
"status": "affected",
"version": "4.15.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.15.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent lock owner use-after-free during client teardown\n\n__destroy_client() releases a client\u0027s open owners, but a lock owner\nwhose only reference is a blocked lock (nbl) stays on\ncl_ownerstr_hashtbl. client_has_state() does not count a bare owner,\nso DESTROY_CLIENTID can reach __destroy_client() with such owners\npresent.\n\n__destroy_client() then walks the table, calling remove_blocked_locks()\non each owner without a reference. Freeing a blocked lock drops the\nowner reference held via flc_owner. The per-net laundromat reaps\nblocked locks from nn-\u003eblocked_locks_lru independently of client state.\nThe two paths share blocked_locks_lock only for the list splice, not\nthe owner\u0027s lifetime. The laundromat therefore frees the owner as\n__destroy_client() dereferences it, a NULL dereference in\nremove_blocked_locks().\n\nnfsd4_release_lockowner() holds a reference across the same call;\n__destroy_client() does not. Hold cl_lock across the walk, taking a\nreference and unhashing each owner, then drop it before\nremove_blocked_locks() and nfs4_put_stateowner(), which take\nblocked_locks_lock and cl_lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in nfsd NFSv4.1 client teardown and blocked-lock handling, reached by remote COMPOUND RPCs on the in-kernel NFS server (TCP/UDP 2049). A network client drives EXCHANGE_ID, CREATE_SESSION, OPEN, blocking LOCK, DESTROY_SESSION, and DESTROY_CLIENTID into __destroy_client().\nAC:L - The attacker controls both sides of the race: one client holds a conflicting lock while another queues a blocked lock, then DESTROY_CLIENTID races with lock-grant/CB_NOTIFY_LOCK or the laundromat freeing that lockowner. Concurrent NFS requests create the race, and it can be retried.\nPR:N - Typical nfsd deployments use AUTH_SYS, which does not cryptographically authenticate the client. A remote peer that can reach an export can create NFSv4.1 state and issue DESTROY_CLIENTID without a local account or kernel capabilities on the server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export. No victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The use-after-free occurs in kernel nfsd lock-owner state on the NFS server host and does not cross a separate security authority such as a VM, guest/host, or IOMMU boundary.\nC:H - This is a use-after-free of the nfs4_lockowner slab object. Reclaiming the freed owner lets an attacker control later reads of so_client and related pointers in remove_blocked_locks(), yielding a kernel information-disclosure primitive.\nI:H - The same UAF is exploitable for integrity: the freed lockowner includes so_ops function pointers and lo_blocked list heads, so heap reuse can hijack control flow or corrupt list pointers for an arbitrary kernel write.\nA:H - The bug is a kernel use-after-free of the lock owner and was observed as a NULL dereference in remove_blocked_locks(), which can oops or panic nfsd and take down the server."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:50:33.792Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42d7954b0a1907d4ef122aef94561952a033cdc3"
},
{
"url": "https://git.kernel.org/stable/c/bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a"
},
{
"url": "https://git.kernel.org/stable/c/b8bad5a11416b26cc7fd4b18fba46d75ff636558"
},
{
"url": "https://git.kernel.org/stable/c/1ce74d1b7770e69735e8f8e509807af4ff9c8ee7"
},
{
"url": "https://git.kernel.org/stable/c/a6ead6fff3a7d03e49845f048f7000a2e0d34431"
},
{
"url": "https://git.kernel.org/stable/c/4804c58f73a80d12df1de323bf97a164f6ee8743"
},
{
"url": "https://git.kernel.org/stable/c/8cf4ff0a7c083dd5e0067f517d63979b74b66649"
},
{
"url": "https://git.kernel.org/stable/c/5e2fa29d223a9a1e6a948e40b109d09081d1decd"
}
],
"title": "NFSD: Prevent lock owner use-after-free during client teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89662",
"datePublished": "2026-09-11T19:45:49.833Z",
"dateReserved": "2026-09-11T19:38:34.744Z",
"dateUpdated": "2026-10-19T08:50:33.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.