CVE-2026-89668

The Linux kernel's nfsd (NFS server) subsystem initializes its debugfs interface before its NFSv4 slab caches in init_nfsd(); if the slab allocation fails, the error path returns without calling nfsd_debugfs_exit(), leaving orphaned debugfs files whose file_operations pointers reference the unloaded module's text. A local attacker with low privileges on a system where the nfsd module load has failed could access these orphaned files under /sys/kernel/debug, invoking stale function pointers in a use-after-free that CVSS rates at 7.8 (local vector, high confidentiality/integrity/availability impact). In practice, triggering the flaw requires debugfs to be mounted and an nfsd initialization failure, so exposure is largely theoretical. The fix reorders initialization so debugfs is created only after the slabs succeed, and adjusts unwind paths to reverse (LIFO) order, a cleanup with no functional change. No public proof of concept exists and no exploitation has been observed.

What to do: Apply distribution kernel updates once the fix is backported, as this is resolved by a simple init-order reordering. On production hosts, verify whether debugfs (/sys/kernel/debug) is mounted and unmount or restrict it if not needed. Watch for failed nfsd module loads followed by accesses to the orphaned nfsd debugfs entries, though no exploitation has been observed.