CVE-2026-89659

The Linux kernel's NFS server (NFSD) contains a use-after-free in which an expired delegation being processed by the nfs4_laundromat is temporarily on neither the cl_delegations nor cl_revoked list, allowing the owning nfs4_client to be torn down and freed while revoke_delegation() is still about to dereference its cl_lock. The bug is triggered when a client's recalled delegation times out and the laundromat revokes it in the same window in which the client's remaining state drops to zero, since the laundromat holds no cl_rpc_users reference that would block free_client(). A remote attacker interacting with the NFS server (e.g., a malicious or carefully timed NFS client) could race this window to corrupt freed kernel memory, potentially achieving kernel-level code execution or crashing the host, consistent with the 9.8 critical CVSS. Affected systems are Linux hosts running the in-kernel nfsd as an NFSv4 server, particularly where delegations are issued; specific fixed version ranges were not specified in the source data, only that the fix pins the client with cl_rpc_users across the revoke. No public proof-of-concept exists and the flaw is not in the CISA KEV catalog, so exploitation status is currently unknown/none known.

What to do: Apply your distribution's updated kernel packages once they include this NFSD fix and reboot (or reload nfsd) so the new code takes effect. Until patched, restrict NFS access at the firewall to trusted client subnets only and avoid exposing port 2049 to the internet. As a temporary mitigation on unpatched hosts, disabling NFSv4 delegations (e.g., via nfsd module/export options) reduces the vulnerable code path; check server logs for nfsd crashes or laundromat anomalies as indicators.