CVE-2026-89659

A flaw was found in the Linux kernel's Network File System Daemon (NFSD). This use-after-free vulnerability occurs during the delegation revoke process. When an expired delegation is unhashed, a timing window exists where the client can be prematurely freed before the revocation is complete. This can lead to a system crash or potentially allow an attacker to execute arbitrary code or disclose sensitive information.

This vulnerability is rated as having an Important impact for Red Hat Enterprise Linux because an attacker communicating with an active NFS server could potentially trigger kernel memory corruption or cause a system crash. Red Hat Enterprise Linux systems are not exposed by default because the NFS server daemon is not enabled on standard installations. Exposure is strictly confined to hosts explicitly configured to export NFSv4 shares where client delegations and lease revocations are actively processed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If NFS server functionality is not required, stop and disable the nfs-server service to eliminate exposure. If the service must remain active, restrict network access to port 2049 (NFS) using firewall rules so only trusted hosts can reach the daemon.

1. Stop and disable the NFS server service:

# systemctl stop nfs-server.service
# systemctl disable nfs-server.service

2. Caveats: Disabling the NFS server service will unexport all shared directories and prevent remote clients from mounting or accessing network shares.

3. Warning: Stopping the service will immediately terminate active NFS connections and disrupt ongoing client file operations.