CVE-2026-89662

CVE CVE-2026-89662EUVD EUVD-2026-76574Published 2026-09-11T19:45:49.000ZLast changed 2026-09-14T12:01:52.000ZCVSS 9.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present. __destroy_client() then walks the table, calling remove_blocked_locks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flc_owner. The per-net laundromat reaps blocked locks from nn->blocked_locks_lru independently of client state. The two paths share blocked_locks_lock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as __destroy_client() dereferences it, a NULL dereference in remove_blocked_locks(). nfsd4_release_lockowner() holds a reference across the same call; __destroy_client() does not. Hold cl_lock across the walk, taking a reference and unhashing each owner, then drop it before remove_blocked_locks() and nfs4_put_stateowner(), which take blocked_locks_lock and cl_lock.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 0f44e9da465ea259b6c9f31a627f3c50a16e1679; 68ef3bc3166468678d5e1fdd216628c35bd1186f <8cf4ff0a7c083dd5e0067f517d63979b74b66649; e294c4c2d33b7307a89cdf31bec08a112d6a9297; 4.9.91 <4.10; 4.15.14 <4.16; 68ef3bc3166468678d5e1fdd216628c35bd1186f <42d7954b0a1907d4ef122aef94561952a033cdc3; 68ef3bc3166468678d5e1fdd216628c35bd1186f <1ce74d1b7770e69735e8f8e509807af4ff9c8ee7; patch: 6.18.50; 68ef3bc3166468678d5e1fdd216628c35bd1186f <5e2fa29d223a9a1e6a948e40b109d09081d1decd; patch: 0; 68ef3bc3166468678d5e1fdd216628c35bd1186f <4804c58f73a80d12df1de323bf97a164f6ee8743; 797bfd05d4040fbf766198b3cfcc1838002cc890; patch: 6.1.188; 68ef3bc3166468678d5e1fdd216628c35bd1186f <a6ead6fff3a7d03e49845f048f7000a2e0d34431; patch: 7.3-rc1; 68ef3bc3166468678d5e1fdd216628c35bd1186f <bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a; 4.16; 4.14.31 <4.15; 68ef3bc3166468678d5e1fdd216628c35bd1186f <b8bad5a11416b26cc7fd4b18fba46d75ff636558; patch: 7.2.4; patch: 5.10.270; patch: 6.6.157; patch: 5.15.221; patch: 6.12.109

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.