CVE-2026-89690

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash (denial of service) or potentially allow an attacker to gain elevated privileges.

This vulnerability is rated as Important severity because local authenticated users could trigger a kernel use-after-free condition to cause a system crash or potentially achieve local privilege escalation. The flaw only affects hosts actively configured and running the kernel-based Network File System (NFS) server, which is disabled by default in standard Red Hat Enterprise Linux installations. Exploitation requires concurrent NFSv4 compound operations alongside netlink status inspection, meaning systems not serving NFS traffic or without active client workloads remain unexposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.