CVE-2026-89662

A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During client teardown, a race condition can occur where a lock owner is freed while still being referenced, leading to a use-after-free vulnerability. This can result in a NULL dereference, potentially causing a system crash and a denial of service.

Red Hat has evaluated this vulnerability as Moderate severity because it only affects systems actively configured as an NFS server and its impact is limited to denial of service via a system crash. The kernel NFS server daemon is not enabled by default on standard Red Hat Enterprise Linux installations. Furthermore, triggering this race condition requires precise synchronization between NFSv4 client state teardown and server-side lock reaping, reducing the likelihood of reliable exploitation beyond kernel disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.