CVE-2026-89670

The Linux kernel's NFS daemon (nfsd) localio path contains a use-after-free race in nfsd_open_local_fh(), where a pointer obtained via cmpxchg can reference an nfsd_file object that was already freed through call_rcu and whose backing slab page (created without SLAB_TYPESAFE_BY_RCU) has been recycled after the RCU grace period elapsed. A racing nfsd_file_put_local on another CPU triggers the flaw, causing refcount_inc_not_zero to operate on recycled memory; a non-zero word at the nf_ref offset makes the increment appear to succeed, after which the caller dereferences new->nf_net and new->nf_file out of freed memory. A local attacker with low privileges who can race this code path can corrupt kernel memory, with the CVSS assessment (7.8, AV:L/PR:L, C:H/I:H/A:H) indicating potential full compromise of confidentiality, integrity, and availability — in practice a plausible local privilege escalation to kernel-level code execution. Only systems running the kernel NFS server together with same-host NFS clients using the localio fast path are exposed to this code. No public proof of concept is known and the issue is not listed in CISA's KEV catalog.

What to do: Apply kernel updates from your distribution once the fix (holding rcu_read_lock across the cmpxchg retry in nfsd_open_local_fh) is backported, and reboot to load the patched kernel. On hosts using same-host nfsd localio, restrict unprivileged local code execution and container workloads until patched. Check whether NFS localio is actually in use (kernel nfsd plus local NFS mounts) to prioritize patching of the genuinely exposed systems.