Answer in brief
CVE-2026-89662 records a Critical severity (CVSS 9.8) vulnerability in NFSD: Prevent lock owner use-after-free during client teardown. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=68ef3bc3166468678d5e1fdd216628c35bd1186f <a6ead6fff3a7d03e49845f048f7000a2e0d34431 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <4804c58f73a80d12df1de323bf97a164f6ee8743 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <8cf4ff0a7c083dd5e0067f517d63979b74b66649 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <5e2fa29d223a9a1e6a948e40b109d09081d1decd || e294c4c2d33b7307a89cdf31bec08a112d6a9297 || 797bfd05d4040fbf766198b3cfcc1838002cc890 || 0f44e9da465ea259b6c9f31a627f3c50a16e1679 || >=4.9.91 <4.10 || >=4.14.31 <4.15 || >=4.15.14 <4.16 | a6ead6fff3a7d03e49845f048f7000a2e0d34431, 4804c58f73a80d12df1de323bf97a164f6ee8743, 8cf4ff0a7c083dd5e0067f517d63979b74b66649, 5e2fa29d223a9a1e6a948e40b109d09081d1decd, 4.10, 4.15, 4.16 |
| Linux/Linuxgeneric | 4.16 | Not reported |
| Linux/Linuxgeneric | >=68ef3bc3166468678d5e1fdd216628c35bd1186f <42d7954b0a1907d4ef122aef94561952a033cdc3 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <b8bad5a11416b26cc7fd4b18fba46d75ff636558 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <1ce74d1b7770e69735e8f8e509807af4ff9c8ee7 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <a6ead6fff3a7d03e49845f048f7000a2e0d34431 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <4804c58f73a80d12df1de323bf97a164f6ee8743 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <8cf4ff0a7c083dd5e0067f517d63979b74b66649 || >=68ef3bc3166468678d5e1fdd216628c35bd1186f <5e2fa29d223a9a1e6a948e40b109d09081d1decd || e294c4c2d33b7307a89cdf31bec08a112d6a9297 || 797bfd05d4040fbf766198b3cfcc1838002cc890 || 0f44e9da465ea259b6c9f31a627f3c50a16e1679 || >=4.9.91 <4.10 || >=4.14.31 <4.15 || >=4.15.14 <4.16 | 42d7954b0a1907d4ef122aef94561952a033cdc3, bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a, b8bad5a11416b26cc7fd4b18fba46d75ff636558, 1ce74d1b7770e69735e8f8e509807af4ff9c8ee7, a6ead6fff3a7d03e49845f048f7000a2e0d34431, 4804c58f73a80d12df1de323bf97a164f6ee8743, 8cf4ff0a7c083dd5e0067f517d63979b74b66649, 5e2fa29d223a9a1e6a948e40b109d09081d1decd, 4.10, 4.15, 4.16 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present. __destroy_client() then walks the table, calling remove_blocked_locks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flc_owner. The per-net laundromat reaps blocked locks from nn->blocked_locks_lru independently of client state. The two paths share blocked_locks_lock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as __destroy_client() dereferences it, a NULL dereference in remove_blocked_locks(). nfsd4_release_lockowner() holds a reference across the same call; __destroy_client() does not. Hold cl_lock across the walk, taking a reference and unhashing each owner, then drop it before remove_blocked_locks() and nfs4_put_stateowner(), which take blocked_locks_lock and cl_lock.
Quoted source text, attributed separately from HOL analysis.