CVE-2026-89661

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the handler confirms that nn->nfsd_serv is set. Once nfsd has shut down, nfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the pointer intact, so the cancel helper iterates freed slab memory as an array of struct list_head and then dereferences a bogus nfs4_client when it takes clp->async_lock. A local administrator holding CAP_SYS_ADMIN can reach this use-after-free by stopping the server and then writing to unlock_filesystem; KASAN reports a slab-use-after-free read in nfsd4_cancel_copy_by_sb(). nfsd4_revoke_states() walks the same state tables and for that reason already runs only under nfsd_mutex with nn->nfsd_serv confirmed present. Move the async COPY cancel into that protected section so every NFSv4 state-table walker on this path observes a running server. Async copies exist only while the server runs, so gating the cancel on nn->nfsd_serv loses nothing.

• https://git.kernel.org/stable/c/0c1a755b7212e0835398d4df5e782ea85ccd7476
• https://git.kernel.org/stable/c/292d915d3ba6fd15eeb88351fa10581683073109

Published

Sep 11, 2026

Last Modified

Sep 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89656In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89657In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-89658In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89659In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-8966Information disclosure in the IP Protection component. This …7.5
• CVE-2026-89660In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89662In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89663In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-89664In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-89665In the Linux kernel, the following vulnerability has been re…8.2
• CVE-2026-89666In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89667In the Linux kernel, the following vulnerability has been re…8.1