CVE-2026-89708

A flaw was found in the Linux kernel's NFS daemon (nfsd). During the teardown of an NFSv4 session, a race condition can occur where the session's memory is freed while an active callback task still holds a reference to it. This can lead to a use-after-free vulnerability, potentially causing system instability, crashes, or denial of service.

This vulnerability is rated as Important because an authenticated NFS client can induce kernel memory corruption or a host denial of service, presenting a critical blast radius against the operating system despite requiring precise timing during session destruction. Red Hat Enterprise Linux systems are not exposed in default installations unless the host is explicitly configured and running as an NFS server. The flaw specifically affects the backchannel callback mechanism during NFSv4 session teardown and does not impact systems functioning strictly as NFS clients.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the NFS server service if NFS exports are not required on the system:

systemctl stop nfs-server.service

systemctl disable nfs-server.service

If NFS exports are required, restrict network access to port 2049 so only trusted client IP addresses or subnets can access the service:

firewall-cmd --permanent --zone=public --remove-service=nfs

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="<trusted_ip_or_subnet>" service name="nfs" accept'

firewall-cmd --reload

Caveats: Stopping nfs-server halts all active file sharing operations. Restricting firewall rules prevents unauthorized clients from connecting to shared volumes.

Warning: Stopping the nfs-server service will terminate active client connections immediately. Reloading firewall rules applies configuration changes immediately.