{"id":"CVE-2026-89682","title":"nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-416","CWE-825"],"vendor":"Linux","product":"Linux","affected":["Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < e6c3a43d0a41f03abae3764fc82a59369360c7e0","Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < 9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67","Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < ba0ee9e04b7a0356c28d5a2fe445db675d24e572","Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < cadc9036d5a8209f89e7026ddba7cfb1c716b03c","Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4","Linux e8f923e1e9fcc0832a12c8a2461792e5a9544c03","Linux 3bc94fb44f10ef852723e1aeaac6794c5ab16aec","Linux >= 5.10.220 < 5.11","Linux >= 5.15.154 < 5.16","Linux 5.17"],"published":"2026-09-11","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:48:18.923Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89682","references":[{"url":"https://git.kernel.org/stable/c/e6c3a43d0a41f03abae3764fc82a59369360c7e0"},{"url":"https://git.kernel.org/stable/c/9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67"},{"url":"https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572"},{"url":"https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"},{"url":"https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89682.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89682"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532019"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89682"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89682"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89682.mbox"},{"url":"https://kernelcve.org/list/?q=CVE-2026-89682"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00552,"epssPercentile":0.4595,"scores":{"cna":8.1,"vendor":5.3},"ingestedAt":"2026-09-14T15:23:07.473Z","slug":"CVE-2026-89682","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue, preventing the shrinker and GC worker from\nbearing the cost of closing files (see ffb402596147).  However, the\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\nThe global shrinker, laundrette, and fsnotify callbacks can still be\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\ncausing a use-after-free.\n\nInline the spinlock and freeme list directly into struct nfsd_net (as\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\nallocated struct nfsd_fcache_disposal entirely.  These fields now have\nthe same lifetime as the net namespace itself, so there is no dangling\npointer to chase.\n\nnfsd_file_cache_start_net() now just initializes the inline fields and\ncannot fail due to allocation.  nfsd_file_cache_shutdown_net() drains\nthe inline list directly instead of freeing a separate struct.  The\nalloc/free helpers are removed.\n\n## Affected\n\n- `Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < e6c3a43d0a41f03abae3764fc82a59369360c7e0`\n- `Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < 9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67`\n- `Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < ba0ee9e04b7a0356c28d5a2fe445db675d24e572`\n- `Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < cadc9036d5a8209f89e7026ddba7cfb1c716b03c`\n- `Linux >= 1463b38e7cf34d4cc60f41daff459ad807b2e408 < bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4`\n- `Linux e8f923e1e9fcc0832a12c8a2461792e5a9544c03`\n- `Linux 3bc94fb44f10ef852723e1aeaac6794c5ab16aec`\n- `Linux >= 5.10.220 < 5.11`\n- `Linux >= 5.15.154 < 5.16`\n- `Linux 5.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89682.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":227212,"id":"CVE-2026-89682","ts":1792587295919,"field":"cvss","old":"5.3","new":"8.1"},{"seq":227211,"id":"CVE-2026-89682","ts":1792587295919,"field":"severity","old":"medium","new":"high"},{"seq":226996,"id":"CVE-2026-89682","ts":1792584972989,"field":"cvss","old":"8.1","new":"5.3"},{"seq":226995,"id":"CVE-2026-89682","ts":1792584972989,"field":"severity","old":"high","new":"medium"},{"seq":224623,"id":"CVE-2026-89682","ts":1792401441883,"field":"cvss","old":"7","new":"8.1"},{"seq":202805,"id":"CVE-2026-89682","ts":1789403724658,"field":"cvss","old":"8.1","new":"7"},{"seq":197746,"id":"CVE-2026-89682","ts":1789384318675,"field":"cvss","old":"6.6","new":"8.1"},{"seq":197745,"id":"CVE-2026-89682","ts":1789384318675,"field":"severity","old":"medium","new":"high"},{"seq":183679,"id":"CVE-2026-89682","ts":1789356676916,"field":"cvss","old":"8.1","new":"6.6"},{"seq":183678,"id":"CVE-2026-89682","ts":1789356676916,"field":"severity","old":"high","new":"medium"},{"seq":153556,"id":"CVE-2026-89682","ts":1789285351269,"field":"cvss","old":null,"new":"8.1"},{"seq":153555,"id":"CVE-2026-89682","ts":1789285351269,"field":"severity","old":"none","new":"high"},{"seq":109638,"id":"CVE-2026-89682","ts":1789183732745,"field":"cvss","old":null,"new":"6.6"},{"seq":109637,"id":"CVE-2026-89682","ts":1789183732745,"field":"severity","old":"none","new":"medium"}]}