Look up another CVE · open CVE-2026-89485 in the interactive tracker
CVE-2026-89485
lockd: pin next file across nlm_inspect_file lock-drop
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem fs/lockd. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89485 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/lockd/svcsubs.c
- What this is
- KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on fs/lockd/ · linux-nfs@vger.kernel.org · Supported
- Kernel module
- lockd
Check it on the machine
grep -w CONFIG_LOCKD /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w lockdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_LOCKD
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.71%, higher than 52.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/lockd
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.18 | 5.10.270 | e3c413f789ea |
| 2.6.18 | 5.15.221 | 08a455f87b14 |
| 2.6.18 | 6.1.188 | 550c19222c71 |
| 2.6.18 | 6.6.157 | 350087f231c1 |
| 2.6.18 | 6.12.109 | c24bdb7df2f3 |
| 2.6.18 | 6.18.50 | 41f0a6d31615 |
| 2.6.18 | 7.2.4 | e999a8813365 |
| 2.6.18 | 7.3 | 526c49cff3f7 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- lockd is the in-kernel NLM RPC server on TCP/UDP, reached by remote NFSv3 clients. nlm_traverse_files() runs on NLMPROC_FREE_ALL, and nlm_release_file() runs from LOCK/UNLOCK/TEST and from rpciod NLM_GRANTED_MSG completion, so the UAF is triggered by network NLM traffic.
- AC:LAttack complexity, low
- A remote NFS client can populate nlm_files via LOCK, send FREE_ALL to drop nlm_file_mutex inside nlm_traverse_files(), and concurrently complete in-flight GRANTED_MSG callbacks so rpciod's nlmsvc_grant_release() calls nlm_release_file() on the unpinned next object; the attacker drives both sides of the race.
- PR:NPrivileges required, none
- lockd_authenticate() accepts RPC_AUTH_NULL and RPC_AUTH_UNIX. FREE_ALL is not a privileged-port callback, and nlm_fopen() opens files with NFSD_MAY_BYPASS_GSS|NFSD_MAY_NLM, so no host account or capability is required.
- UI:NUser interaction, none
- Exploitation uses only attacker-sent NLM RPCs (LOCK/FREE_ALL and grant-callback completion); no victim user or administrator action is required.
- S:UScope, unchanged
- The use-after-free is in the host kernel's lockd file table and impacts that same kernel; it does not cross a VM, IOMMU, or other security-authority boundary.
- C:HConfidentiality impact, high
- The iterator dereferences a kfree'd struct nlm_file (list pointers, f_file[], f_count). This UAF lets an attacker reuse the slab object and obtain a kernel read primitive, so confidentiality impact is high.
- I:HIntegrity impact, high
- The same nlm_file UAF is a kernel heap free of list nodes, mutex state, and struct file pointers, which can be sprayed for an arbitrary write and control-flow hijack, so integrity impact is high.
- A:HAvailability impact, high
- Walking the freed nlm_file in nlm_traverse_files() causes a kernel oops/panic (KASAN slab-use-after-free), so availability impact is high.