---
id: CVE-2026-22989
title: 'nfsd: check that server is running in unlock_filesystem'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: check that server is running in unlock_filesystem

  If we are trying to unlock the filesystem via an administrative
  interface and nfsd isn't running, it crashes th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1ac3629bf012592cb0320e52a1cceb319a05ad17 <
    d95499900fe52f3d461ed26b7a30bebea8f12914
  - >-
    Linux >= 1ac3629bf012592cb0320e52a1cceb319a05ad17 <
    e06c9f6c0f554148d4921c2a15bd054260a054ac
  - >-
    Linux >= 1ac3629bf012592cb0320e52a1cceb319a05ad17 <
    d0424066fcd294977f310964bed6f2a487fa4515
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:17:53.325028Z'
published: '2026-01-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:14.041Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22989'
references:
  - url: 'https://git.kernel.org/stable/c/d95499900fe52f3d461ed26b7a30bebea8f12914'
  - url: 'https://git.kernel.org/stable/c/e06c9f6c0f554148d4921c2a15bd054260a054ac'
  - url: 'https://git.kernel.org/stable/c/d0424066fcd294977f310964bed6f2a487fa4515'
tags:
  - cve.org
epss: 0.00135
epssPercentile: 0.03011
ingestedAt: '2026-11-05T22:38:32.059Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check that server is running in unlock_filesystem

If we are trying to unlock the filesystem via an administrative
interface and nfsd isn't running, it crashes the server. This
happens currently because nfsd4_revoke_states() access state
structures (eg., conf_id_hashtbl) that has been freed as a part
of the server shutdown.

[   59.465072] Call trace:
[   59.465308]  nfsd4_revoke_states+0x1b4/0x898 [nfsd] (P)
[   59.465830]  write_unlock_fs+0x258/0x440 [nfsd]
[   59.466278]  nfsctl_transaction_write+0xb0/0x120 [nfsd]
[   59.466780]  vfs_write+0x1f0/0x938
[   59.467088]  ksys_write+0xfc/0x1f8
[   59.467395]  __arm64_sys_write+0x74/0xb8
[   59.467746]  invoke_syscall.constprop.0+0xdc/0x1e8
[   59.468177]  do_el0_svc+0x154/0x1d8
[   59.468489]  el0_svc+0x40/0xe0
[   59.468767]  el0t_64_sync_handler+0xa0/0xe8
[   59.469138]  el0t_64_sync+0x1ac/0x1b0

Ensure this can't happen by taking the nfsd_mutex and checking that
the server is still up, and then holding the mutex across the call to
nfsd4_revoke_states().

## Affected

- `Linux >= 1ac3629bf012592cb0320e52a1cceb319a05ad17 < d95499900fe52f3d461ed26b7a30bebea8f12914`
- `Linux >= 1ac3629bf012592cb0320e52a1cceb319a05ad17 < e06c9f6c0f554148d4921c2a15bd054260a054ac`
- `Linux >= 1ac3629bf012592cb0320e52a1cceb319a05ad17 < d0424066fcd294977f310964bed6f2a487fa4515`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.