CVE-2026-89682: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89682 is a use-after-free (UAF) vulnerability in the Linux kernel's NFS server (nfsd) subsystem, specifically in the fcache_disposal mechanism. The flaw arises during per-net namespace teardown, where global shrinker, laundrette, and fsnotify callbacks can still be executing inside nfsd_file_dispose_list_delayed() while the separately-allocated struct nfsd_fcache_disposal has already been freed. Affected kernel versions include 5.10.220–5.11 and 5.15.154–5.16 stable series, as well as 5.17 and later up to the patched releases. The vulnerability was published on September 11, 2026, with a CVSS base score of 0.0 (not yet fully scored; estimated Medium severity) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-416 (Use After Free) / CWE-825 (Expired Pointer Dereference). The nfsd_file_dispose_list_delayed() function defers fput() calls to nfsd service threads via a per-net freeme queue stored in a separately-allocated struct nfsd_fcache_disposal. During per-net teardown, nfsd_free_fcache_disposal_net() frees this struct, but concurrent callbacks (global shrinker, laundrette, fsnotify) may still hold a reference to the now-freed pointer, triggering a UAF condition. The fix inlines the spinlock (fcache_dispose_lock) and freeme list (fcache_dispose_list) directly into struct nfsd_net, tying their lifetime to the net namespace and eliminating the dangling pointer (Github Advisory, Red Hat CVE).

Exploitation of this UAF vulnerability could lead to kernel memory corruption, system crashes (denial of service), or potentially privilege escalation depending on attacker-controlled memory layout at the time of the race condition. The vulnerability is confined to systems running the Linux kernel with the nfsd (NFS server) subsystem active, and exploitation requires the ability to trigger concurrent per-net teardown alongside nfsd file cache operations. While the CVSS score has not been fully assigned, the kernel-level nature of the flaw means successful exploitation could compromise the entire host (Red Hat CVE, Github Advisory).

As of the publication date (September 11, 2026), there are no known public proof-of-concept exploits, no reported in-the-wild exploitation, and no threat actor attribution for this vulnerability. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local or privileged access to trigger the race condition during NFS server teardown (Github Advisory, Red Hat CVE).

The fix has been backported to stable kernel branches: commit ba0ee9e04b7a (5.10.x branch), cadc9036d5a8 (5.15.x branch), and bbf13732f743 (mainline). Unaffected versions include Linux kernel 6.18.51 and later in the 6.18.x series, 7.2.4 and later in the 7.2.x series, and 7.3-rc1 and later. Administrators should update to a patched kernel version as soon as possible. As a temporary workaround, disabling the nfsd (NFS server) subsystem on systems where it is not required will eliminate exposure to this vulnerability (Github Advisory, Red Hat CVE).