Executive brief
The Linux kernel's NFS server (nfsd) contains a reference counting bug in how it manages file state objects during operation replay. A local attacker or user on a system exporting NFS shares could trigger a use-after-free condition, leading to kernel crashes, memory corruption, or potential privilege escalation. This affects systems relying on NFS for file sharing and access control.
Technical details
The vulnerability is a reference counting bug in the NFSv4 server's nfs4_preprocess_seqid_op() function. When handling seqid operation replay in error conditions (-EAGAIN from nfsd4_cstate_assign_replay()), the code incorrectly calls nfs4_put_stateowner() to release a reference it never acquired, causing a refcount underflow on the stateowner object. Simultaneously, it leaks a reference on the stateid object (st_stid). The root cause is improper error handling that drops the wrong object type. The fix changes one function call (nfs4_put_stateowner to nfs4_put_stid) to drop the reference actually held. The vulnerability is triggered on the NFS server side during NFSv4 operations with replay, requiring network access to an NFS export and can occur without authentication depending on NFS share configuration.
Affected products
- Linux Linux Kernel multiple versions (fix backported across 2.6.11.y through 7.2.y stable branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89688 published on NVD
- 2026-06-11: patched: Fix committed upstream (5e4627d3513e60accfce9d5f4c7fa95251ef93d6) by Jeff Layton
- 2026-08-10: patched: Fix merged to stable branches
- 2026-09-07: patched: Fix released in stable kernels