CVE-2026-89682

The Linux kernel's NFS server (nfsd) contains a use-after-free in its file-cache disposal logic: nfsd_file_dispose_list_delayed() defers fput() calls to service threads via a per-network-namespace 'freeme' queue held in a separately allocated struct nfsd_fcache_disposal, which is freed when the network namespace is torn down. However, the global shrinker, the 'laundrette' garbage-collection worker, and fsnotify callbacks can still be executing nfsd_file_dispose_list_delayed() and dereference the freed pointer, triggering a use-after-free. An attacker who can influence this race — for example by inducing memory pressure that invokes the shrinker, or fsnotify activity during namespace teardown — could corrupt kernel memory, with the CVSS 3.1 base score of 8.1 reflecting high impact to confidentiality, integrity, and availability, though attack complexity is high and no exploit is currently known. Any system running an affected kernel that serves NFS via in-kernel nfsd (typically Linux servers and NAS appliances, including containers or environments where network namespaces are created and destroyed) is potentially exposed. The fix eliminates the separate allocation by inlining the disposal lock and list into struct nfsd_net, giving them the same lifetime as the network namespace itself; no public proof-of-concept exists and the flaw is not listed in CISA's KEV catalog.

What to do: Apply a kernel update containing the nfsd fcache disposal fix (which inlines the disposal state into struct nfsd_net) as soon as your distribution ships it, prioritizing multi-tenant hosts, NFS servers, and systems with heavy container/network-namespace churn. Do not expose NFS (port 2049) to the internet — restrict it to trusted internal networks with firewall rules. If patching must be deferred, monitor for kernel oops/panic traces in nfsd_file_dispose_list_delayed or memory-pressure-driven shrinker paths and consider limiting unprivileged network-namespace creation.