{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89682", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.748Z", "datePublished": "2026-09-11T19:46:04.882Z", "dateUpdated": "2026-09-11T19:46:04.882Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:46:04.882Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue, preventing the shrinker and GC worker from\nbearing the cost of closing files (see ffb402596147). However, the\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\nThe global shrinker, laundrette, and fsnotify callbacks can still be\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\ncausing a use-after-free.\n\nInline the spinlock and freeme list directly into struct nfsd_net (as\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\nallocated struct nfsd_fcache_disposal entirely. These fields now have\nthe same lifetime as the net namespace itself, so there is no dangling\npointer to chase.\n\nnfsd_file_cache_start_net() now just initializes the inline fields and\ncannot fail due to allocation. nfsd_file_cache_shutdown_net() drains\nthe inline list directly instead of freeing a separate struct. The\nalloc/free helpers are removed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/filecache.c", "fs/nfsd/netns.h"], "versions": [{"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "ba0ee9e04b7a0356c28d5a2fe445db675d24e572", "status": "affected", "versionType": "git"}, {"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "cadc9036d5a8209f89e7026ddba7cfb1c716b03c", "status": "affected", "versionType": "git"}, {"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "lessThan": "bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4", "status": "affected", "versionType": "git"}, {"version": "e8f923e1e9fcc0832a12c8a2461792e5a9544c03", "status": "affected", "versionType": "git"}, {"version": "3bc94fb44f10ef852723e1aeaac6794c5ab16aec", "status": "affected", "versionType": "git"}, {"version": "5.10.220", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.154", "lessThan": "5.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/filecache.c", "fs/nfsd/netns.h"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.3-rc1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.220"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.154"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572"}, {"url": "https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"}, {"url": "https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4"}], "title": "nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/filecache.c", "fs/nfsd/netns.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ba0ee9e04b7a0356c28d5a2fe445db675d24e572", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"lessThan": "cadc9036d5a8209f89e7026ddba7cfb1c716b03c", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"lessThan": "bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4", "status": "affected", "version": "1463b38e7cf34d4cc60f41daff459ad807b2e408", "versionType": "git"}, {"status": "affected", "version": "e8f923e1e9fcc0832a12c8a2461792e5a9544c03", "versionType": "git"}, {"status": "affected", "version": "3bc94fb44f10ef852723e1aeaac6794c5ab16aec", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.220", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.154", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/filecache.c", "fs/nfsd/netns.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue, preventing the shrinker and GC worker from\nbearing the cost of closing files (see ffb402596147). However, the\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\nThe global shrinker, laundrette, and fsnotify callbacks can still be\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\ncausing a use-after-free.\n\nInline the spinlock and freeme list directly into struct nfsd_net (as\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\nallocated struct nfsd_fcache_disposal entirely. These fields now have\nthe same lifetime as the net namespace itself, so there is no dangling\npointer to chase.\n\nnfsd_file_cache_start_net() now just initializes the inline fields and\ncannot fail due to allocation. nfsd_file_cache_shutdown_net() drains\nthe inline list directly instead of freeing a separate struct. The\nalloc/free helpers are removed."}], "id": "CVE-2026-89682", "lastModified": "2026-09-11T20:19:55.043", "metrics": {}, "published": "2026-09-11T20:19:55.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Kernel: NFS daemon (nfsd) use-after-free vulnerability in file cache disposal", "id": "2532019", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532019"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's NFS daemon (nfsd) component. The nfsd_file_dispose_list_delayed() function, responsible for deferring file disposal, uses a separately allocated structure for its freeme queue. During network namespace teardown, this structure can be prematurely freed. This allows other kernel callbacks to attempt to dereference the freed memory, leading to a use-after-free (UAF) vulnerability. A local attacker could potentially exploit this to cause a system crash or escalate privileges."], "name": "CVE-2026-89682", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:46:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89682\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89682\nhttps://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572\nhttps://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4\nhttps://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"], "threat_severity": "Important"}

{"created": "2026-09-12T06:30:09.004453+00:00", "updated": "2026-09-12T11:45:03.769938+00:00", "vendors": []}