CVE-2026-89708 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpc_task that dereferences clp->cl_cb_session. nfsd4_probe_callback_sync() flushes cl_callback_wq, but once nfsd4_run_cb_work() has called rpc_call_async() the rpc_task lives on rpciod; flushing the workqueue does not wait for it. rpc_shutdown_client() does drain rpciod tasks, but uses a 1-second wait_event_timeout — tasks stuck in rpc_delay() (e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.
destroy path rpciod ------------ ------ unhash_session(ses) nfsd4_probe_callback_sync(clp) flush_workqueue(cl_callback_wq) /* returns; rpc_task still live */ nfsd4_put_session_locked(ses) free_session(ses) -> kfree(ses) nfsd4_cb_sequence_done() reads cb_clp->cl_cb_session /* freed slab */
A second window exists in nfsd4_process_cb_update(). When __nfsd4_find_backchannel() returns NULL because unhash_session() has already removed the destroyed session from cl_sessions, setup_callback_client() takes the v4.1 early return so clp->cl_cb_session = ses never fires and the field retains a pointer to the about-to-be-freed session.
Fix both by converting cl_cb_session to an RCU-protected pointer:
- Move the cl_cb_session = ses assignment in setup_callback_client() to after rpc_create() succeeds, so it is only published when a working backchannel exists. Clear cl_cb_session on the error return in nfsd4_process_cb_update(). Both stores use rcu_assign_pointer().
- Annotate cl_cb_session with __rcu. All rpciod-side readers use rcu_read_lock()/rcu_dereference() and check for NULL, bailing to the appropriate error or requeue path: encode_cb_sequence4args(), decode_cb_sequence4resok(), nfsd41_cb_get_slot(), nfsd41_cb_release_slot(), nfsd4_cb_prepare(), and nfsd4_cb_sequence_done().
- Switch __free_session() from kfree() to kfree_rcu() so the session slab is not reclaimed until after an RCU grace period, guaranteeing that rpciod readers inside rcu_read_lock() never dereference freed memory.
- Pass the session pointer to the nfsd_cb_seq_status and nfsd_cb_free_slot tracepoints instead of having them re-read cl_cb_session.
- nfsd4_cb_prepare() calls rpc_exit() when the session is NULL, routing through the done/release path to requeue the callback.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel NFS server implementation contains a critical use-after-free vulnerability within the session teardown logic for NFSv4 callbacks. This flaw arises from a race condition between the destruction of an NFS client session and asynchronous Remote Procedure Call tasks managed by the rpciod subsystem. Specifically, when a DESTROY_SESSION command is processed, the per-session teardown path may free the session structure while rpciod still holds an inflight callback rpc_task that attempts to dereference the cl_cb_session pointer within that structure. Although nfsd4_probe_callback_sync() flushes the callback workqueue, this action only ensures that queued work items are completed; it does not wait for asynchronous RPC tasks already dispatched to the rpciod thread pool to finish execution. Consequently, a race condition exists where the session memory is reclaimed before these background threads have finished accessing it.
The operational mechanics of this vulnerability involve two distinct windows of exposure during session management. In the primary scenario, after unhashing the session and flushing the callback workqueue, nfsd4_put_session_locked() proceeds to free the session structure via kfree(). However, an rpc_task running in rpciod may subsequently invoke functions such as nfsd4_cb_sequence_done(), which reads clp->cl_cb_session. Since the memory has already been returned to the slab allocator and potentially reallocated for other purposes, this dereference results in a use-after-free condition. A second window exists within nfsd4_process_cb_update(). If __nfsd4_find_backchannel() returns NULL because unhash_session() has already removed the session from the client's list of sessions, setup_callback_client() takes an early return path that fails to update clp->cl_cb_session. This leaves the pointer referencing a session object that is about to be freed, creating another potential dereference of invalid memory during subsequent callback processing.
This vulnerability aligns with CWE-416, Use After Free, and can be mapped to MITRE ATT&CK techniques related to exploitation of software errors or potentially privilege escalation if an attacker can trigger the specific race condition sequence through crafted NFS requests. The impact includes kernel panic due to memory corruption, data leakage from previously freed structures being reused for new allocations with different contents, or denial of service affecting the stability of the NFS server and potentially the entire host system. Such instability undermines the reliability of network file sharing services in enterprise environments where consistent availability is critical.
The resolution involves converting the cl_cb_session pointer to an RCU-protected field to ensure safe concurrent access between readers and writers without requiring heavy locking mechanisms that could introduce latency or deadlocks. The fix moves the assignment of cl_cb_session in setup_callback_client() to occur only after rpc_create() succeeds, ensuring the pointer is published solely when a valid backchannel exists. Error paths are updated to clear this field using rcu_assign_pointer(). All readers within the rpciod context, including functions like encode_cb_sequence4args and nfsd41_cb_get_slot, now utilize rcu_read_lock and rcu_dereference with NULL checks to safely access the session pointer. Furthermore, the free mechanism is changed from kfree to kfree_rcu, which delays the actual memory reclamation until after an RCU grace period has elapsed. This guarantees that any reader currently inside an RCU read-side critical section will complete its execution before the memory is freed, effectively eliminating the race condition and preventing use-after-free exploits.