CVE-2026-89682

A flaw was found in the Linux kernel's NFS daemon (nfsd) component. The nfsd_file_dispose_list_delayed() function, responsible for deferring file disposal, uses a separately allocated structure for its freeme queue. During network namespace teardown, this structure can be prematurely freed. This allows other kernel callbacks to attempt to dereference the freed memory, leading to a use-after-free (UAF) vulnerability. A local attacker could potentially exploit this to cause a system crash or escalate privileges.

A use-after-free exists in the NFSD file cache disposal path because a separately allocated per-net disposal object can be freed during net namespace teardown while global shrinker, laundrette, or fsnotify callbacks may still be inside nfsd_file_dispose_list_delayed() and dereference it. The bug is a race condition with a real UAF primitive against a spinlock and list head used for deferred file disposal, so the realistic impact is at least a kernel crash or local denial of service. For the CVSS the PR:L is used for the paranoid score because reduced-capability root, container service context, or delegated nfsd namespace management may be enough to reach the affected teardown and disposal paths. The issue is not directly network reachable as a standalone packet-triggered bug. Remote NFS traffic may help populate or age the file cache, but reliable triggering depends on local nfsd or net namespace lifecycle control. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.