GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89682 (GCVE-0-2026-89682)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing files (see ffb402596147). However, the queue lives in a separately-allocated struct nfsd_fcache_disposal that is freed by nfsd_free_fcache_disposal_net() during per-net teardown. The global shrinker, laundrette, and fsnotify callbacks can still be inside nfsd_file_dispose_list_delayed() dereferencing that pointer, causing a use-after-free. Inline the spinlock and freeme list directly into struct nfsd_net (as fcache_dispose_lock and fcache_dispose_list), eliminating the separately allocated struct nfsd_fcache_disposal entirely. These fields now have the same lifetime as the net namespace itself, so there is no dangling pointer to chase. nfsd_file_cache_start_net() now just initializes the inline fields and cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains the inline list directly instead of freeing a separate struct. The alloc/free helpers are removed.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1463b38e7cf34d4cc60f41daff459ad807b2e408 , < ba0ee9e04b7a0356c28d5a2fe445db675d24e572 (git)
Affected: 1463b38e7cf34d4cc60f41daff459ad807b2e408 , < cadc9036d5a8209f89e7026ddba7cfb1c716b03c (git)
Affected: 1463b38e7cf34d4cc60f41daff459ad807b2e408 , < bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4 (git)
Affected: e8f923e1e9fcc0832a12c8a2461792e5a9544c03 (git)
Affected: 3bc94fb44f10ef852723e1aeaac6794c5ab16aec (git)
Affected: 5.10.220 , < 5.11 (semver)
Affected: 5.15.154 , < 5.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/filecache.c",
            "fs/nfsd/netns.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba0ee9e04b7a0356c28d5a2fe445db675d24e572",
              "status": "affected",
              "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
              "versionType": "git"
            },
            {
              "lessThan": "cadc9036d5a8209f89e7026ddba7cfb1c716b03c",
              "status": "affected",
              "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
              "versionType": "git"
            },
            {
              "lessThan": "bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4",
              "status": "affected",
              "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e8f923e1e9fcc0832a12c8a2461792e5a9544c03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bc94fb44f10ef852723e1aeaac6794c5ab16aec",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.220",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.154",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/filecache.c",
            "fs/nfsd/netns.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.220",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue, preventing the shrinker and GC worker from\nbearing the cost of closing files (see ffb402596147).  However, the\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\nThe global shrinker, laundrette, and fsnotify callbacks can still be\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\ncausing a use-after-free.\n\nInline the spinlock and freeme list directly into struct nfsd_net (as\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\nallocated struct nfsd_fcache_disposal entirely.  These fields now have\nthe same lifetime as the net namespace itself, so there is no dangling\npointer to chase.\n\nnfsd_file_cache_start_net() now just initializes the inline fields and\ncannot fail due to allocation.  nfsd_file_cache_shutdown_net() drains\nthe inline list directly instead of freeing a separate struct.  The\nalloc/free helpers are removed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd_file_dispose_list_delayed() runs in the in-kernel NFS server filecache on nfsd_files cached from remote OPEN/READ/WRITE over TCP/UDP 2049; a network NFS client populates that cache and can drive delayed dispose via the global GC laundrette, shrinker, or fsnotify from REMOVE, matching kernel guidance that nfsd is Network.\nAC:H - The UAF requires nfsd_free_fcache_disposal_net() to kfree the separately allocated per-net nfsd_fcache_disposal during nfsd_file_cache_shutdown_net() while the global shrinker, laundrette, or fsnotify still dereference it\u2014a victim-side nfsd restart, shutdown, or netns teardown the remote attacker cannot cause, only race against.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with IP-based exports, so a remote peer that can reach the export self-asserts credentials with no cryptographic authentication and can OPEN/READ files into the filecache; no local Linux account or capability is required.\nUI:N - The attacker issues NFS operations that populate and reclaim the filecache themselves; nfsd per-net teardown is an environmental race counted under Attack Complexity, not an interactive victim action such as mounting a filesystem or opening a file.\nS:U - The use-after-free corrupts host-kernel slab (struct nfsd_fcache_disposal) within the same OS security authority as nfsd and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a slab use-after-free of the kmalloc\u0027d nfsd_fcache_disposal object; reclaim or spray of the freed object lets dispose_list_delayed read attacker-controlled lock and list_head fields, enabling arbitrary kernel disclosure per UAF guidance.\nI:H - spin_lock and list_move_tail on the freed disposal object write into reclaimed slab, corrupting list nodes and lock state and yielding a groomable write or control-flow hijack primitive characteristic of exploitable kernel UAFs.\nA:H - Use-after-free of the disposal spinlock and list from shrinker, GC worker, or fsnotify context causes kernel oops, panic, or list-corruption hangs, fully disrupting availability of the NFS server host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:06.103Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572"
        },
        {
          "url": "https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4"
        }
      ],
      "title": "nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89682",
    "datePublished": "2026-09-11T19:46:04.882Z",
    "dateReserved": "2026-09-11T19:38:34.748Z",
    "dateUpdated": "2026-09-13T06:33:06.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89682",
      "date": "2026-09-15",
      "epss": "0.00397",
      "percentile": "0.33347"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89682\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:55.043\",\"lastModified\":\"2026-09-13T07:17:34.003\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\\n\\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\\nvia a per-net freeme queue, preventing the shrinker and GC worker from\\nbearing the cost of closing files (see ffb402596147).  However, the\\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\\nThe global shrinker, laundrette, and fsnotify callbacks can still be\\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\\ncausing a use-after-free.\\n\\nInline the spinlock and freeme list directly into struct nfsd_net (as\\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\\nallocated struct nfsd_fcache_disposal entirely.  These fields now have\\nthe same lifetime as the net namespace itself, so there is no dangling\\npointer to chase.\\n\\nnfsd_file_cache_start_net() now just initializes the inline fields and\\ncannot fail due to allocation.  nfsd_file_cache_shutdown_net() drains\\nthe inline list directly instead of freeing a separate struct.  The\\nalloc/free helpers are removed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/filecache.c\",\"fs/nfsd/netns.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1463b38e7cf34d4cc60f41daff459ad807b2e408\",\"lessThan\":\"ba0ee9e04b7a0356c28d5a2fe445db675d24e572\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1463b38e7cf34d4cc60f41daff459ad807b2e408\",\"lessThan\":\"cadc9036d5a8209f89e7026ddba7cfb1c716b03c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1463b38e7cf34d4cc60f41daff459ad807b2e408\",\"lessThan\":\"bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8f923e1e9fcc0832a12c8a2461792e5a9544c03\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3bc94fb44f10ef852723e1aeaac6794c5ab16aec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.220\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.154\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/filecache.c\",\"fs/nfsd/netns.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T08:28:55+00:00",
      "cve": "CVE-2026-89682",
      "id": "CVE-2026-89682",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89682.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:20Z",
      "cve": "CVE-2026-89682",
      "id": "CVE-2026-89682",
      "initial_release_date": "2026-09-15T00:57:10Z",
      "product_status:known_affected": "168",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89682",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89682.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.