{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89668", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.745Z", "datePublished": "2026-09-11T19:45:54.354Z", "dateUpdated": "2026-09-11T19:45:54.354Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:45:54.354Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()\n\nnfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd().\nIf the slab allocation fails, the bare \"return retval\" bypasses\nnfsd_debugfs_exit(), leaving orphan debugfs files with stale fops\npointers into the freed module text.\n\nMove nfsd_debugfs_init() to after the slab init succeeds, so the\nearly return has no debugfs state to clean up.\n\nSince debugfs is now the more recently initialized of the two, also\nupdate the unwind paths to match reverse-initialization (LIFO) order:\nrun nfsd_debugfs_exit() before nfsd4_free_slabs() in both the\ninit_nfsd() error path and exit_nfsd(). The nfsd debugfs files only\nreference module-global state and have no dependency on the slab\ncaches, so that reordering is a cleanup with no functional change."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfsctl.c"], "versions": [{"version": "9fe5ea760e64f04412dbed51645a0dac7220d40a", "lessThan": "4ae5d7490ae6a7b83b3d607f88c499f4f85e753a", "status": "affected", "versionType": "git"}, {"version": "9fe5ea760e64f04412dbed51645a0dac7220d40a", "lessThan": "ab43ff94f5dfc2b6a080b167b69855eb7655c98b", "status": "affected", "versionType": "git"}, {"version": "9fe5ea760e64f04412dbed51645a0dac7220d40a", "lessThan": "2c390c8a1764d67095fe444401861fac4c049362", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfsctl.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4ae5d7490ae6a7b83b3d607f88c499f4f85e753a"}, {"url": "https://git.kernel.org/stable/c/ab43ff94f5dfc2b6a080b167b69855eb7655c98b"}, {"url": "https://git.kernel.org/stable/c/2c390c8a1764d67095fe444401861fac4c049362"}], "title": "nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfsctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4ae5d7490ae6a7b83b3d607f88c499f4f85e753a", "status": "affected", "version": "9fe5ea760e64f04412dbed51645a0dac7220d40a", "versionType": "git"}, {"lessThan": "ab43ff94f5dfc2b6a080b167b69855eb7655c98b", "status": "affected", "version": "9fe5ea760e64f04412dbed51645a0dac7220d40a", "versionType": "git"}, {"lessThan": "2c390c8a1764d67095fe444401861fac4c049362", "status": "affected", "version": "9fe5ea760e64f04412dbed51645a0dac7220d40a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfsctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()\n\nnfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd().\nIf the slab allocation fails, the bare \"return retval\" bypasses\nnfsd_debugfs_exit(), leaving orphan debugfs files with stale fops\npointers into the freed module text.\n\nMove nfsd_debugfs_init() to after the slab init succeeds, so the\nearly return has no debugfs state to clean up.\n\nSince debugfs is now the more recently initialized of the two, also\nupdate the unwind paths to match reverse-initialization (LIFO) order:\nrun nfsd_debugfs_exit() before nfsd4_free_slabs() in both the\ninit_nfsd() error path and exit_nfsd(). The nfsd debugfs files only\nreference module-global state and have no dependency on the slab\ncaches, so that reordering is a cleanup with no functional change."}], "id": "CVE-2026-89668", "lastModified": "2026-09-11T20:19:53.290", "metrics": {}, "published": "2026-09-11T20:19:53.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c390c8a1764d67095fe444401861fac4c049362"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ae5d7490ae6a7b83b3d607f88c499f4f85e753a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab43ff94f5dfc2b6a080b167b69855eb7655c98b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel: nfsd use-after-free due to incorrect debugfs initialization order", "id": "2532527", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532527"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the `nfsd` component of the Linux kernel. The `nfsd_debugfs_init()` function is called before `nfsd4_init_slabs()`. If the slab allocation fails, the `nfsd_debugfs_exit()` cleanup function is bypassed, leaving orphaned debugfs files with stale function pointers. This can lead to a use-after-free vulnerability, potentially allowing a local attacker to cause a denial of service or escalate privileges."], "name": "CVE-2026-89668", "public_date": "2026-09-11T19:45:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89668\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89668\nhttps://git.kernel.org/stable/c/2c390c8a1764d67095fe444401861fac4c049362\nhttps://git.kernel.org/stable/c/4ae5d7490ae6a7b83b3d607f88c499f4f85e753a\nhttps://git.kernel.org/stable/c/ab43ff94f5dfc2b6a080b167b69855eb7655c98b"], "threat_severity": "Important"}

{"created": "2026-09-12T12:00:12.123309+00:00", "updated": "2026-09-12T12:00:12.123316+00:00", "vendors": [], "weaknesses": ["CWE-416"]}