GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89682 (GCVE-0-2026-89682)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing files (see ffb402596147). However, the queue lives in a separately-allocated struct nfsd_fcache_disposal that is freed by nfsd_free_fcache_disposal_net() during per-net teardown. The global shrinker, laundrette, and fsnotify callbacks can still be inside nfsd_file_dispose_list_delayed() dereferencing that pointer, causing a use-after-free. Inline the spinlock and freeme list directly into struct nfsd_net (as fcache_dispose_lock and fcache_dispose_list), eliminating the separately allocated struct nfsd_fcache_disposal entirely. These fields now have the same lifetime as the net namespace itself, so there is no dangling pointer to chase. nfsd_file_cache_start_net() now just initializes the inline fields and cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains the inline list directly instead of freeing a separate struct. The alloc/free helpers are removed.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1463b38e7cf34d4cc60f41daff459ad807b2e408 , < ba0ee9e04b7a0356c28d5a2fe445db675d24e572 (git)
Affected: 1463b38e7cf34d4cc60f41daff459ad807b2e408 , < cadc9036d5a8209f89e7026ddba7cfb1c716b03c (git)
Affected: 1463b38e7cf34d4cc60f41daff459ad807b2e408 , < bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4 (git)
Affected: e8f923e1e9fcc0832a12c8a2461792e5a9544c03 (git)
Affected: 3bc94fb44f10ef852723e1aeaac6794c5ab16aec (git)
Affected: 5.10.220 , < 5.11 (semver)
Affected: 5.15.154 , < 5.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/filecache.c",
            "fs/nfsd/netns.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba0ee9e04b7a0356c28d5a2fe445db675d24e572",
              "status": "affected",
              "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
              "versionType": "git"
            },
            {
              "lessThan": "cadc9036d5a8209f89e7026ddba7cfb1c716b03c",
              "status": "affected",
              "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
              "versionType": "git"
            },
            {
              "lessThan": "bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4",
              "status": "affected",
              "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e8f923e1e9fcc0832a12c8a2461792e5a9544c03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bc94fb44f10ef852723e1aeaac6794c5ab16aec",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.220",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.154",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/filecache.c",
            "fs/nfsd/netns.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.220",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue, preventing the shrinker and GC worker from\nbearing the cost of closing files (see ffb402596147).  However, the\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\nThe global shrinker, laundrette, and fsnotify callbacks can still be\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\ncausing a use-after-free.\n\nInline the spinlock and freeme list directly into struct nfsd_net (as\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\nallocated struct nfsd_fcache_disposal entirely.  These fields now have\nthe same lifetime as the net namespace itself, so there is no dangling\npointer to chase.\n\nnfsd_file_cache_start_net() now just initializes the inline fields and\ncannot fail due to allocation.  nfsd_file_cache_shutdown_net() drains\nthe inline list directly instead of freeing a separate struct.  The\nalloc/free helpers are removed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd_file_dispose_list_delayed() runs in the in-kernel NFS server filecache on nfsd_files cached from remote OPEN/READ/WRITE over TCP/UDP 2049; a network NFS client populates that cache and can drive delayed dispose via the global GC laundrette, shrinker, or fsnotify from REMOVE, matching kernel guidance that nfsd is Network.\nAC:H - The UAF requires nfsd_free_fcache_disposal_net() to kfree the separately allocated per-net nfsd_fcache_disposal during nfsd_file_cache_shutdown_net() while the global shrinker, laundrette, or fsnotify still dereference it\u2014a victim-side nfsd restart, shutdown, or netns teardown the remote attacker cannot cause, only race against.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with IP-based exports, so a remote peer that can reach the export self-asserts credentials with no cryptographic authentication and can OPEN/READ files into the filecache; no local Linux account or capability is required.\nUI:N - The attacker issues NFS operations that populate and reclaim the filecache themselves; nfsd per-net teardown is an environmental race counted under Attack Complexity, not an interactive victim action such as mounting a filesystem or opening a file.\nS:U - The use-after-free corrupts host-kernel slab (struct nfsd_fcache_disposal) within the same OS security authority as nfsd and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a slab use-after-free of the kmalloc\u0027d nfsd_fcache_disposal object; reclaim or spray of the freed object lets dispose_list_delayed read attacker-controlled lock and list_head fields, enabling arbitrary kernel disclosure per UAF guidance.\nI:H - spin_lock and list_move_tail on the freed disposal object write into reclaimed slab, corrupting list nodes and lock state and yielding a groomable write or control-flow hijack primitive characteristic of exploitable kernel UAFs.\nA:H - Use-after-free of the disposal spinlock and list from shrinker, GC worker, or fsnotify context causes kernel oops, panic, or list-corruption hangs, fully disrupting availability of the NFS server host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:06.103Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572"
        },
        {
          "url": "https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4"
        }
      ],
      "title": "nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89682",
    "datePublished": "2026-09-11T19:46:04.882Z",
    "dateReserved": "2026-09-11T19:38:34.748Z",
    "dateUpdated": "2026-09-13T06:33:06.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89682",
      "date": "2026-09-16",
      "epss": "0.00397",
      "percentile": "0.33508"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89682\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:55.043\",\"lastModified\":\"2026-09-13T07:17:34.003\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\\n\\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\\nvia a per-net freeme queue, preventing the shrinker and GC worker from\\nbearing the cost of closing files (see ffb402596147).  However, the\\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\\nThe global shrinker, laundrette, and fsnotify callbacks can still be\\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\\ncausing a use-after-free.\\n\\nInline the spinlock and freeme list directly into struct nfsd_net (as\\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\\nallocated struct nfsd_fcache_disposal entirely.  These fields now have\\nthe same lifetime as the net namespace itself, so there is no dangling\\npointer to chase.\\n\\nnfsd_file_cache_start_net() now just initializes the inline fields and\\ncannot fail due to allocation.  nfsd_file_cache_shutdown_net() drains\\nthe inline list directly instead of freeing a separate struct.  The\\nalloc/free helpers are removed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/filecache.c\",\"fs/nfsd/netns.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1463b38e7cf34d4cc60f41daff459ad807b2e408\",\"lessThan\":\"ba0ee9e04b7a0356c28d5a2fe445db675d24e572\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1463b38e7cf34d4cc60f41daff459ad807b2e408\",\"lessThan\":\"cadc9036d5a8209f89e7026ddba7cfb1c716b03c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1463b38e7cf34d4cc60f41daff459ad807b2e408\",\"lessThan\":\"bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8f923e1e9fcc0832a12c8a2461792e5a9544c03\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3bc94fb44f10ef852723e1aeaac6794c5ab16aec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.220\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.154\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/filecache.c\",\"fs/nfsd/netns.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T08:28:55+00:00",
      "cve": "CVE-2026-89682",
      "id": "CVE-2026-89682",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89682.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:20Z",
      "cve": "CVE-2026-89682",
      "id": "CVE-2026-89682",
      "initial_release_date": "2026-09-15T00:57:10Z",
      "product_status:known_affected": "168",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89682",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89682.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.