CVE-2026-89675

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free (UAF) vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory corruption and system instability. This issue arises when a teardown caller races with the copy kernel thread, leading to incorrect memory management.

An Important-severity use-after-free flaw in the Linux kernel's nfsd server affects Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that ship RHEL CoreOS. The flaw is in the lifetime management of asynchronous NFSv4.2 server-side copy operations: when an OFFLOAD_CANCEL request from an NFS client, an nfsd shutdown, or a superblock-level cancel races the copy worker thread, missing reference counting allows the async copy object, its nfsd_file state, or the copy kthread's task_struct to be freed while still in use. Exploitation requires an authenticated NFS client that can issue server-side copy requests against the affected NFS server and win a narrow timing window during copy teardown; a successful attack causes kernel memory corruption, most probably a kernel panic and resulting denial of service of the NFS server. Red Hat rates this flaw Important (CVSS 7.0), lower than the upstream CVEORG rating of Critical (9.8), because successful exploitation depends on winning a race condition during copy teardown rather than a deterministic attack path. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. Fixes are being pursued for the affected products through their respective update streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.