In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by… (CVE-2026-89709)
A use-after-free vulnerability in the Linux kernel's lockd and nfsd components was resolved. The issue involved unsafe handling of the nlmsvc_ops pointer, which could lead to NULL dereference or module-text use-after-free after the nfsd module is removed. The fix involved proper RCU (Read-Copy-Update) protection and reference counting to prevent stale pointer dereferences.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's lockd and nfsd subsystems was due to nlmsvc_ops being published and cleared with plain stores, while lockd dereferenced it without proper guarding. This led to potential NULL dereference or use-after-free conditions when the nfsd module was removed. The patch introduced __rcu declaration for nlmsvc_ops, used rcu_assign_pointer() and RCU_INIT_POINTER() with synchronize_rcu() for safe updates, and added module reference counting with try_module_get/module_put to pin the module during indirect calls. Additionally, fallback to fput() was added to avoid leaking file references during binding teardown.
Potential Impact
The vulnerability could cause kernel crashes or undefined behavior due to NULL pointer dereference or use-after-free conditions in the kernel module nfsd after it is removed. This may impact system stability and security by allowing kernel memory corruption.
Mitigation Recommendations
A fix has been implemented in the Linux kernel that properly protects nlmsvc_ops with RCU mechanisms and module reference counting. Users should update to the fixed kernel version once available. No additional mitigation is indicated.
In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by… (CVE-2026-89709)
Description
A use-after-free vulnerability in the Linux kernel's lockd and nfsd components was resolved. The issue involved unsafe handling of the nlmsvc_ops pointer, which could lead to NULL dereference or module-text use-after-free after the nfsd module is removed. The fix involved proper RCU (Read-Copy-Update) protection and reference counting to prevent stale pointer dereferences.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's lockd and nfsd subsystems was due to nlmsvc_ops being published and cleared with plain stores, while lockd dereferenced it without proper guarding. This led to potential NULL dereference or use-after-free conditions when the nfsd module was removed. The patch introduced __rcu declaration for nlmsvc_ops, used rcu_assign_pointer() and RCU_INIT_POINTER() with synchronize_rcu() for safe updates, and added module reference counting with try_module_get/module_put to pin the module during indirect calls. Additionally, fallback to fput() was added to avoid leaking file references during binding teardown.
Potential Impact
The vulnerability could cause kernel crashes or undefined behavior due to NULL pointer dereference or use-after-free conditions in the kernel module nfsd after it is removed. This may impact system stability and security by allowing kernel memory corruption.
Mitigation Recommendations
A fix has been implemented in the Linux kernel that properly protects nlmsvc_ops with RCU mechanisms and module reference counting. Users should update to the fixed kernel version once available. No additional mitigation is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g58f-8h46-hjgv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89709"]
Threat ID: 6aa49ffd55bf5e2cf5a865ed
Added to database: 09/12/2026, 00:42:37 UTC
Last enriched: 09/12/2026, 00:52:33 UTC
Last updated: 09/12/2026, 00:52:33 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.