CVE-2026-89709

The Linux kernel's lockd file-locking service dereferences the nlmsvc_ops callback table without any synchronization, while the nfsd module publishes and clears that pointer with plain stores during module load/unload. If the nfsd kernel module is unloaded (rmmod) while lockd is servicing an NLM request from fs/lockd/svcsubs.c, lockd can load a stale pointer, producing either a NULL dereference or a use-after-free against nfsd's unloaded module text. Successful exploitation of the race would let an attacker crash the kernel (denial of service) and potentially execute code in kernel context, though the CVSS attack complexity is high because the window depends on the module-teardown race. Affected systems are Linux machines running the NFS server with NFSv3/lockd locking enabled and nfsd built as a loadable module. The upstream fix RCU-protects the pointer and pins the module with try_module_get/module_put across indirect calls; no public PoC or exploitation in the wild is known.

What to do: Apply distribution kernel updates containing the fix that RCU-protects nlmsvc_ops and pins the nfsd module (try_module_get/module_put) across indirect calls. Operationally, avoid unloading the nfsd/lockd modules while NFS shares or NLM locking activity is live — stop NFS services and quiesce lock state first. Review kernel logs on NFS servers for lockd oopses or use-after-free splats as an indicator of the race having been hit.