CVE-2026-89709 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free.
Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the Linux kernel involves a race condition within the Network File System (NFS) daemon subsystem, specifically affecting the interaction between nfsd and lockd modules. The core issue stems from improper synchronization of the nlmsvc_ops pointer during module initialization and shutdown sequences. This function pointer structure is published by nfsd_lockd_init using standard store operations and cleared in nfsd_lockd_shutdown via plain stores as well. However, concurrent access to this pointer occurs within dispatch sites located in fs/lockd/svcsubs.c without adequate Read-Copy-Update (RCU) protection mechanisms. This lack of synchronization creates a window where the lockd module may attempt to dereference nlmsvc_ops after it has been invalidated or freed by nfsd, leading to critical memory safety violations.
From a technical perspective, this flaw represents a classic use-after-free scenario combined with potential null pointer dereferences. The nlmsvc_ops structure resides in the read-only data section of the nfsd module, while its callback functions are located in the text segment. When an administrator removes the nfsd kernel module using rmmod, the memory backing these structures is freed or reclaimed. If a lockd thread subsequently attempts to invoke one of these callbacks through the now-stale pointer, it results in undefined behavior. Depending on timing and system state, this can manifest as a null pointer dereference causing an immediate kernel panic or, more dangerously, execution of arbitrary code if the memory has been reallocated for other purposes. This aligns with CWE-416 Use After Free and CWE-825 Expired Pointer Dereference in common vulnerability enumeration standards.
The operational impact of this vulnerability is significant due to its potential for remote exploitation or local privilege escalation depending on the attack vector. An attacker who can trigger NFS locking operations while simultaneously inducing module unloading could crash the system, leading to a denial-of-service condition. In more sophisticated scenarios where memory layout allows control over reallocated structures, an attacker might achieve arbitrary code execution with kernel privileges. This falls under ATT&CK technique T1059 Command and Scripting Interpreter if leveraged for further exploitation or T1496 Resource Hijacking in the context of denial-of-service impacts on critical infrastructure services relying on NFS stability.
The resolution implemented by the Linux kernel maintainers addresses these issues through rigorous application of RCU synchronization primitives and module reference counting. The nlmsvc_ops pointer is now declared with __rcu attributes to enforce proper usage semantics across read-side and write-side contexts. Publication of the new operations structure utilizes rcu_assign_pointer, which ensures memory ordering guarantees necessary for safe concurrent access. Conversely, clearing the pointer employs RCU_INIT_POINTER followed by synchronize_rcu, guaranteeing that all pre-existing readers have completed their critical sections before the old data is freed. Additionally, a struct module owner field was added to nlmsvc_binding to pin the nfsd module in memory during indirect calls via try_module_get and module_put sequences. This prevents the module from being unloaded while its code is still executing. Finally, proper cleanup logic using fput ensures that file structure references are correctly released when bindings are torn down, preventing resource leaks that could otherwise lead to denial-of-service conditions over time.