CVE-2026-22989: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22989 is a denial-of-service vulnerability in the Linux kernel's NFS daemon (nfsd) unlock_filesystem administrative interface. When a user attempts to unlock a filesystem via the nfsd administrative interface while nfsd is not running, the kernel crashes because nfsd4_revoke_states() accesses state structures (e.g., conf_id_hashtbl) that have already been freed during server shutdown — a use-after-free condition. The vulnerability was disclosed on January 23, 2026, and affects Linux kernel versions 6.9 through 6.12.65, 6.13 through 6.18.5, and 6.19-rc1 through rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a use-after-free condition (classified as NVD-CWE-noinfo due to insufficient information, but functionally a use-after-free) in the write_unlock_fs() function within the nfsd kernel module. When nfsd is shut down, its internal state structures — including conf_id_hashtbl — are freed; however, the unlock_filesystem administrative path does not verify that nfsd is still running before invoking nfsd4_revoke_states(), which dereferences those freed structures. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it accessible to any local user with permission to write to the nfsd administrative interface (e.g., /proc/fs/nfsd/). The fix involves acquiring nfsd_mutex and checking server state before proceeding with nfsd4_revoke_states() (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in a kernel crash (panic), causing a complete denial of service on the affected system. There is no confidentiality or integrity impact — the vulnerability is limited to availability (A:H). Systems running NFS servers on affected kernel versions are at risk of being crashed by a local low-privileged user, potentially disrupting NFS file-sharing services and any workloads dependent on the affected host (Red Hat Advisory, Red Hat Bugzilla).

1. Identify target: Confirm the target system is running a vulnerable Linux kernel version (6.9–6.12.65, 6.13–6.18.5, or 6.19-rc1 through rc4) with the nfsd module loaded but the nfsd service currently stopped.
2. Obtain local access: Gain local access to the system with at least low-privileged credentials and write access to the nfsd administrative interface (e.g., /proc/fs/nfsd/unlock_filesystem or equivalent).
3. Trigger the vulnerability: Write a filesystem unlock command to the nfsd administrative interface while nfsd is not running. This causes write_unlock_fs() to call nfsd4_revoke_states(), which dereferences already-freed state structures such as conf_id_hashtbl.
4. Kernel crash: The use-after-free dereference triggers a kernel panic, crashing the system and causing a denial of service (Red Hat Bugzilla).

• Logs: Kernel panic or oops messages in /var/log/kern.log or dmesg output referencing nfsd4_revoke_states, write_unlock_fs, or nfsctl_transaction_write in the call trace.
• Logs: Unexpected system reboots or crash dumps (kdump) on NFS server hosts, particularly following nfsd service stop events.
• Process/Behavior: Writes to the nfsd administrative interface (e.g., /proc/fs/nfsd/) by non-root or low-privileged users when nfsd is not running.

Upgrade to a patched Linux kernel version: 6.12.66 or later for the 6.9–6.12 branch, or 6.18.6 or later for the 6.13–6.18 branch. Patches are available in the Linux kernel stable tree at the referenced kernel.org commits. As a workaround, restrict write access to the nfsd administrative interface to trusted administrators only, and ensure nfsd is running before any filesystem unlock operations are performed. Red Hat has tracked this issue via Bugzilla and downstream distributions (Oracle Linux, SUSE) have also released updated kernel packages (Red Hat Bugzilla, Oracle Advisory, SUSE Advisory).