CVE-2026-89668

A flaw was found in the nfsd component of the Linux kernel. The nfsd_debugfs_init() function is called before nfsd4_init_slabs(). If the slab allocation fails, the nfsd_debugfs_exit() cleanup function is bypassed, leaving orphaned debugfs files with stale function pointers. This can lead to a use-after-free vulnerability, potentially allowing a local attacker to cause a denial of service or escalate privileges.

An NFSD module initialization failure can leave debugfs files behind with stale fops pointers into module text that is no longer valid. This happens when nfsd_debugfs_init() succeeds but nfsd4_init_slabs() fails and the init path returns without removing the debugfs entries. A later access to the orphan /sys/kernel/debug/nfsd files can dereference freed module code pointers, causing a kernel crash and creating a UAF-style control flow risk. For the CVSS the PR:L reflects the paranoid case where a local user or service account can access the orphan debugfs interface after the failed module initialization, while reliable creation of that state is harder and normally administrative. The issue is not network reachable through NFS traffic. Impact is at least local denial of service and in the worst case may include confidentiality or integrity impact due to stale function pointers into freed module text.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.