CVE-2026-89670

A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. A race condition exists in the nfsd_open_local_fh() function where an nfsd_file object can be freed and its memory recycled while another process attempts to access it. This can lead to a use-after-free vulnerability, allowing an attacker to potentially cause memory corruption, disclose sensitive information, or execute arbitrary code.

A use after free race exists in the nfsd localio path because nfsd_open_local_fh can load an nfsd_file pointer with cmpxchg and then call nfsd_file_get without holding an RCU read side critical section. The object is freed through call_rcu and the cache is not SLAB_TYPESAFE_BY_RCU, so after the RCU grace period the backing memory can be recycled before the refcount operation and later dereferences of nf_net and nf_file. For the CVSS the PR:L is used because a local user or local process normally needs access to a local NFS mount or localio capable NFS workflow, while administrative setup of NFS localio is a deployment prerequisite rather than the direct attacker privilege. The issue is not directly network reachable for ordinary remote NFS clients because the affected path is localio. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact or privilege escalation due to use after free on recycled kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.