Linux Kernel NFSD CVE-2026-89682

Exploitation requires: (1) nfsd actively serving NFS in a Linux network namespace that is undergoing teardown - most commonly a Docker or Kubernetes container, or an explicit ip-netns namespace, running an NFS server that is stopped or deleted; (2) concurrent execution of the kernel memory shrinker callback, the nfsd laundromat garbage-collector timer, or a fsnotify callback that calls nfsd_file_dispose_list_delayed() at the precise moment nfsd_free_fcache_disposal_net() has freed the disposal struct. High NFS client load increasing memory pressure raises the probability of the shrinker being active during teardown, making the race more likely under stress. The vulnerability cannot be triggered by crafted NFS protocol messages alone without a concurrent privileged teardown action. Running nfsd exclusively in the initial network namespace (default non-containerized deployment) greatly reduces exposure because the initial netns is not destroyed during normal operation.

The assigned CVSS vector (AV:N/AC:H/PR:N) substantially overstates exploitability: no crafted NFS network packet alone can trigger this race - the vulnerable window requires a privileged administrative actor to tear down the network namespace or stop nfsd while the kernel shrinker or laundromat is concurrently dereferencing the disposal struct. Even a mid-sized municipal IT team in olsztyn running containerized NFS workloads would find reliable exploitation impractical without simultaneous control over namespace lifecycle and system memory pressure timing. The EPSS of 0.17% (6th percentile) correctly reflects that race-condition kernel UAFs of this class see near-zero opportunistic exploitation, and neither CISA KEV listing nor public proof-of-concept code has been identified. Real-world impact is primarily availability loss (kernel panic, crash), with controlled heap corruption as an upper bound requiring additional kernel exploitation primitives. The mislabeled Information Disclosure tag in the input adds further noise and understates the memory safety nature of the bug. Priority: normal kernel patch cycle; no emergency response warranted absent a KEV addition.

An operator stops or deletes a container running an NFS server (nfsd) in its own network namespace while the system is under memory pressure from heavy NFS client load. As nfsd_free_fcache_disposal_net() frees the nfsd_fcache_disposal struct, the kernel's concurrently-running memory shrinker or laundromat timer calls nfsd_file_dispose_list_delayed() and dereferences the now-freed spinlock or list head, causing a slab use-after-free that crashes the kernel or corrupts heap metadata. No public proof-of-concept exists; reliable exploitation requires winning a timing race whose window varies with system load and scheduling.