Look up another CVE · open CVE-2026-89709 in the interactive tracker

CVE-2026-89709

lockd, nfsd: RCU-protect nlmsvc_ops dispatch

8.1 EPSS 0.5% AV:N

Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem fs/lockd. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-89709 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	vulnerable	6.1.190-1	No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication.
Debian 13trixie	vulnerable	6.12.113-1	No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication.
Debian 14forky	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/lockd/svc.c
fs/lockd/svc4proc.c
fs/lockd/svcproc.c
fs/lockd/svcsubs.c
fs/nfsd/lockd.c
include/linux/lockd/bind.h

What this is: KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on fs/lockd/ · linux-nfs@vger.kernel.org · Supported
Kernel module: lockd

Check it on the machine

grep -w CONFIG_LOCKD /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w lockd

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_LOCKD

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-09-11 (37 days ago)source
CVSS: 8.1 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.53%, higher than 43.9% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: fs/lockd

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.12	6.18.57	836ce2b99bcc
2.6.12	7.2.4	3c461a182008
2.6.12	7.3	641e5e208523

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: lockd is the in-kernel NLM RPC server on TCP/UDP (rpcbind-registered) used with nfsd. nlm_do_fopen() and nlm_delete_file() run from NLM LOCK/TEST/UNLOCK/FREE_ALL in svc_recv, so a remote NFS/NLM peer reaches the unguarded nlmsvc_ops->fopen/fclose dispatch.
AC:HAttack complexity, high: The UAF requires exit_nfsd()/rmmod nfsd to NULL nlmsvc_ops with a plain store and free nfsd .text while lockd still dispatches. A remote attacker can flood NLM requests but cannot unload nfsd; that victim-side module teardown is beyond attacker control.
PR:NPrivileges required, none: lockd_authenticate() accepts RPC_AUTH_NULL and RPC_AUTH_UNIX before procedure dispatch. nlm_fopen() uses NFSD_MAY_BYPASS_GSS|NFSD_MAY_NLM, and typical exports use AUTH_SYS, so no host account or capability is required.
UI:NUser interaction, none: Exploitation is driven by attacker-sent NLM RPCs to an already-running lockd; no victim user must mount a filesystem or open a file. nfsd unload is an environmental timing condition, not User Interaction.
S:UScope, unchanged: The module-text UAF and NULL deref corrupt host kernel lockd/nfsd state within the same OS security authority and do not cross a VM, IOMMU, or sandbox boundary.
C:HConfidentiality impact, high: After rmmod, a stale nlmsvc_ops load calls fopen/fclose from freed nfsd .rodata/.text. Reclaim of those module pages lets the attacker control the indirect-call target, yielding an arbitrary kernel read per UAF guidance.
I:HIntegrity impact, high: Indirect call through a dangling nlmsvc_binding in freed nfsd module memory is a RIP-hijack primitive; spraying recycled module pages enables arbitrary kernel write and control-flow hijack, so integrity impact is high.
A:HAvailability impact, high: A stale nlmsvc_ops load after rmmod nfsd is either a NULL deref or a call into unmapped module text; both oops/panic the kernel, so availability impact is high.