{"cve":"CVE-2026-89670","nvd":{"published":"2026-09-11T20:19:53.517","modified":"2026-10-19T09:18:05.130","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: hold rcu across localio cmpxchg retry\n\nnfsd_file objects are freed via call_rcu (filecache.c:296), and\nnfsd_file_slab is created without SLAB_TYPESAFE_BY_RCU\n(KMEM_CACHE(nfsd_file, 0) at filecache.c:789), so the slab page\nbacking a freed nfsd_file becomes freely reclaimable once the RCU\ngrace period elapses.\n\nThe again: retry block in nfsd_open_local_fh() loads a pointer with\ncmpxchg and then calls nfsd_file_get(new) (which is\nrefcount_inc_not_zero) without holding rcu_read_lock. The sole caller\nnfs_open_local_fh() drops rcu_read_lock before invoking this helper,\nso no outer reader-side critical section covers the load.\n\n    CPU 0 (nfsd_open_local_fh)        CPU 1 (nfsd_file_put_local)\n    -----                             -----\n    new = cmpxchg(pnf, NULL, ...)\n                                      nf = xchg(pnf, NULL)\n                                      nfsd_file_put(nf)\n                                        last ref -> call_rcu()\n                                      /* grace period elapses;\n                                         slab page recycled */\n    nfsd_file_get(new)\n      refcount_inc_not_zero(&new->nf_ref)\n      /* operates on recycled memory */\n\nA non-zero word at the nf_ref offset of the recycled object makes the\nrefcount bump appear to succeed, and the caller then dereferences\nnew->nf_net and new->nf_file out of freed memory.\n\nFix by taking rcu_read_lock() immediately before the cmpxchg and\nreleasing it on all three exits of the if (new) block: the goto-again\nretry, the lost-race cleanup path, and the install-succeeded path.\nnfsd_file_put() and nfsd_net_put() stay outside the RCU section so\nthey remain free to block.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/559570f91a7d4d199a72105e4980bef791f4cbf1","https://git.kernel.org/stable/c/58884694978a3d7d111edb433d7fd6a6c5af2f34","https://git.kernel.org/stable/c/763c0bad872368304db718f79af7e93048885c67"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-89670","score":0.00173,"percentile":0.06721,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}