Linux Kernel up to 7.2.3 lockd fs/lockd/svcsubs.c nfsd_lockd_init use after free

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.3. It has been declared as very critical. This vulnerability affects the function nfsd_lockd_init of the file fs/lockd/svcsubs.c of the component lockd. Such manipulation leads to use after free. This vulnerability is listed as CVE-2026-89709. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.3 and classified as very critical. Affected by this issue is the function nfsd_lockd_init of the file fs/lockd/svcsubs.c of the component lockd. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-89709 since 09/11/2026. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/11/2026).

Upgrading to version 7.2.4 or 7.3-rc1 eliminates this vulnerability. Applying the patch 3c461a1820088fb5889d73a6522369bde45527a9/641e5e20852359b8c31149be4598884e30652f60 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion