GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89662 (GCVE-0-2026-89662)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
NFSD: Prevent lock owner use-after-free during client teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present. __destroy_client() then walks the table, calling remove_blocked_locks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flc_owner. The per-net laundromat reaps blocked locks from nn->blocked_locks_lru independently of client state. The two paths share blocked_locks_lock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as __destroy_client() dereferences it, a NULL dereference in remove_blocked_locks(). nfsd4_release_lockowner() holds a reference across the same call; __destroy_client() does not. Hold cl_lock across the walk, taking a reference and unhashing each owner, then drop it before remove_blocked_locks() and nfs4_put_stateowner(), which take blocked_locks_lock and cl_lock.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 42d7954b0a1907d4ef122aef94561952a033cdc3 (git)
Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a (git)
Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < b8bad5a11416b26cc7fd4b18fba46d75ff636558 (git)
Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 1ce74d1b7770e69735e8f8e509807af4ff9c8ee7 (git)
Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < a6ead6fff3a7d03e49845f048f7000a2e0d34431 (git)
Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 4804c58f73a80d12df1de323bf97a164f6ee8743 (git)
Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 8cf4ff0a7c083dd5e0067f517d63979b74b66649 (git)
Affected: 68ef3bc3166468678d5e1fdd216628c35bd1186f , < 5e2fa29d223a9a1e6a948e40b109d09081d1decd (git)
Affected: e294c4c2d33b7307a89cdf31bec08a112d6a9297 (git)
Affected: 797bfd05d4040fbf766198b3cfcc1838002cc890 (git)
Affected: 0f44e9da465ea259b6c9f31a627f3c50a16e1679 (git)
Affected: 4.9.91 , < 4.10 (semver)
Affected: 4.14.31 , < 4.15 (semver)
Affected: 4.15.14 , < 4.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "42d7954b0a1907d4ef122aef94561952a033cdc3",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "b8bad5a11416b26cc7fd4b18fba46d75ff636558",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "1ce74d1b7770e69735e8f8e509807af4ff9c8ee7",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "a6ead6fff3a7d03e49845f048f7000a2e0d34431",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "4804c58f73a80d12df1de323bf97a164f6ee8743",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "8cf4ff0a7c083dd5e0067f517d63979b74b66649",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "5e2fa29d223a9a1e6a948e40b109d09081d1decd",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e294c4c2d33b7307a89cdf31bec08a112d6a9297",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "797bfd05d4040fbf766198b3cfcc1838002cc890",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0f44e9da465ea259b6c9f31a627f3c50a16e1679",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.91",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.31",
              "versionType": "semver"
            },
            {
              "lessThan": "4.16",
              "status": "affected",
              "version": "4.15.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.15.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent lock owner use-after-free during client teardown\n\n__destroy_client() releases a client\u0027s open owners, but a lock owner\nwhose only reference is a blocked lock (nbl) stays on\ncl_ownerstr_hashtbl.  client_has_state() does not count a bare owner,\nso DESTROY_CLIENTID can reach __destroy_client() with such owners\npresent.\n\n__destroy_client() then walks the table, calling remove_blocked_locks()\non each owner without a reference.  Freeing a blocked lock drops the\nowner reference held via flc_owner.  The per-net laundromat reaps\nblocked locks from nn-\u003eblocked_locks_lru independently of client state.\nThe two paths share blocked_locks_lock only for the list splice, not\nthe owner\u0027s lifetime.  The laundromat therefore frees the owner as\n__destroy_client() dereferences it, a NULL dereference in\nremove_blocked_locks().\n\nnfsd4_release_lockowner() holds a reference across the same call;\n__destroy_client() does not.  Hold cl_lock across the walk, taking a\nreference and unhashing each owner, then drop it before\nremove_blocked_locks() and nfs4_put_stateowner(), which take\nblocked_locks_lock and cl_lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in nfsd NFSv4.1 client teardown and blocked-lock handling, reached by remote COMPOUND RPCs on the in-kernel NFS server (TCP/UDP 2049). A network client drives EXCHANGE_ID, CREATE_SESSION, OPEN, blocking LOCK, DESTROY_SESSION, and DESTROY_CLIENTID into __destroy_client().\nAC:L - The attacker controls both sides of the race: one client holds a conflicting lock while another queues a blocked lock, then DESTROY_CLIENTID races with lock-grant/CB_NOTIFY_LOCK or the laundromat freeing that lockowner. Concurrent NFS requests create the race, and it can be retried.\nPR:N - Typical nfsd deployments use AUTH_SYS, which does not cryptographically authenticate the client. A remote peer that can reach an export can create NFSv4.1 state and issue DESTROY_CLIENTID without a local account or kernel capabilities on the server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export. No victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The use-after-free occurs in kernel nfsd lock-owner state on the NFS server host and does not cross a separate security authority such as a VM, guest/host, or IOMMU boundary.\nC:H - This is a use-after-free of the nfs4_lockowner slab object. Reclaiming the freed owner lets an attacker control later reads of so_client and related pointers in remove_blocked_locks(), yielding a kernel information-disclosure primitive.\nI:H - The same UAF is exploitable for integrity: the freed lockowner includes so_ops function pointers and lo_blocked list heads, so heap reuse can hijack control flow or corrupt list pointers for an arbitrary kernel write.\nA:H - The bug is a kernel use-after-free of the lock owner and was observed as a NULL dereference in remove_blocked_locks(), which can oops or panic nfsd and take down the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:52.387Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/42d7954b0a1907d4ef122aef94561952a033cdc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8bad5a11416b26cc7fd4b18fba46d75ff636558"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ce74d1b7770e69735e8f8e509807af4ff9c8ee7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6ead6fff3a7d03e49845f048f7000a2e0d34431"
        },
        {
          "url": "https://git.kernel.org/stable/c/4804c58f73a80d12df1de323bf97a164f6ee8743"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cf4ff0a7c083dd5e0067f517d63979b74b66649"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e2fa29d223a9a1e6a948e40b109d09081d1decd"
        }
      ],
      "title": "NFSD: Prevent lock owner use-after-free during client teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89662",
    "datePublished": "2026-09-11T19:45:49.833Z",
    "dateReserved": "2026-09-11T19:38:34.744Z",
    "dateUpdated": "2026-09-14T12:01:52.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89662",
      "date": "2026-09-16",
      "epss": "0.00684",
      "percentile": "0.50858"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:46:51.000Z",
      "cve": "CVE-2026-89662",
      "id": "msrc_CVE-2026-89662",
      "initial_release_date": "2026-09-13T01:01:49.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "NFSD: Prevent lock owner use-after-free during client teardown",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89662.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89662\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:52.523\",\"lastModified\":\"2026-09-14T13:19:18.370\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFSD: Prevent lock owner use-after-free during client teardown\\n\\n__destroy_client() releases a client\u0027s open owners, but a lock owner\\nwhose only reference is a blocked lock (nbl) stays on\\ncl_ownerstr_hashtbl.  client_has_state() does not count a bare owner,\\nso DESTROY_CLIENTID can reach __destroy_client() with such owners\\npresent.\\n\\n__destroy_client() then walks the table, calling remove_blocked_locks()\\non each owner without a reference.  Freeing a blocked lock drops the\\nowner reference held via flc_owner.  The per-net laundromat reaps\\nblocked locks from nn-\u003eblocked_locks_lru independently of client state.\\nThe two paths share blocked_locks_lock only for the list splice, not\\nthe owner\u0027s lifetime.  The laundromat therefore frees the owner as\\n__destroy_client() dereferences it, a NULL dereference in\\nremove_blocked_locks().\\n\\nnfsd4_release_lockowner() holds a reference across the same call;\\n__destroy_client() does not.  Hold cl_lock across the walk, taking a\\nreference and unhashing each owner, then drop it before\\nremove_blocked_locks() and nfs4_put_stateowner(), which take\\nblocked_locks_lock and cl_lock.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"68ef3bc3166468678d5e1fdd216628c35bd1186f\",\"lessThan\":\"42d7954b0a1907d4ef122aef94561952a033cdc3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68ef3bc3166468678d5e1fdd216628c35bd1186f\",\"lessThan\":\"bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68ef3bc3166468678d5e1fdd216628c35bd1186f\",\"lessThan\":\"b8bad5a11416b26cc7fd4b18fba46d75ff636558\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68ef3bc3166468678d5e1fdd216628c35bd1186f\",\"lessThan\":\"1ce74d1b7770e69735e8f8e509807af4ff9c8ee7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68ef3bc3166468678d5e1fdd216628c35bd1186f\",\"lessThan\":\"a6ead6fff3a7d03e49845f048f7000a2e0d34431\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68ef3bc3166468678d5e1fdd216628c35bd1186f\",\"lessThan\":\"4804c58f73a80d12df1de323bf97a164f6ee8743\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68ef3bc3166468678d5e1fdd216628c35bd1186f\",\"lessThan\":\"8cf4ff0a7c083dd5e0067f517d63979b74b66649\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68ef3bc3166468678d5e1fdd216628c35bd1186f\",\"lessThan\":\"5e2fa29d223a9a1e6a948e40b109d09081d1decd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e294c4c2d33b7307a89cdf31bec08a112d6a9297\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"797bfd05d4040fbf766198b3cfcc1838002cc890\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f44e9da465ea259b6c9f31a627f3c50a16e1679\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.9.91\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.31\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.15.14\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ce74d1b7770e69735e8f8e509807af4ff9c8ee7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/42d7954b0a1907d4ef122aef94561952a033cdc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4804c58f73a80d12df1de323bf97a164f6ee8743\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e2fa29d223a9a1e6a948e40b109d09081d1decd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8cf4ff0a7c083dd5e0067f517d63979b74b66649\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a6ead6fff3a7d03e49845f048f7000a2e0d34431\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b8bad5a11416b26cc7fd4b18fba46d75ff636558\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T13:23:52+00:00",
      "cve": "CVE-2026-89662",
      "id": "CVE-2026-89662",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFSD: Prevent lock owner use-after-free during client teardown",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89662.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:00:49Z",
      "cve": "CVE-2026-89662",
      "id": "CVE-2026-89662",
      "initial_release_date": "2026-09-16T00:00:49Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89662",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89662.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.