Linux Kernel CVE-2026-89709

Three concurrent conditions are required: (1) the target Linux system is operating as an NFS server with both the nfsd and lockd kernel modules loaded and actively serving NFSv2 or NFSv3 clients that use file locking (LOCK/UNLOCK operations); (2) a user with CAP_SYS_MODULE privilege (effectively root) executes rmmod nfsd, unloads the nfsd module via modprobe -r, or triggers an unclean nfsd service stop that races module teardown; and (3) a lockd dispatch call referencing nlmsvc_ops is in-flight at the precise moment nfsd_lockd_shutdown() clears the pointer. Systems running NFSv4-only (which uses a different locking mechanism integrated into the NFS protocol) are not affected via this specific path. Systems that never dynamically unload nfsd during active service are not exposed. The AV:N/PR:N in the provided CVSS vector is inconsistent with the description - network access from NFS clients contributes to the race window but cannot independently trigger the vulnerability without the local privileged rmmod action.

The provided CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N) materially overstates the attack vector and privilege requirements. Triggering the race requires a local privileged action - rmmod nfsd or equivalent module unload - which demands CAP_SYS_MODULE (effectively root). Remote NFS clients contribute in-flight lock requests that create the concurrent execution window, but they cannot independently initiate the race; the local privileged teardown is the necessary precondition. A more accurate vector is AV:L/AC:H/PR:H, reducing the real-world score to approximately 6.3. EPSS of 0.15% (5th percentile) aligns with this reassessment - the combination of race timing, privileged local access, and NFSv2/v3 lockd configuration makes opportunistic exploitation impractical. No KEV listing and no POC exist. Practical impact is DoS-dominant (kernel panic from NULL deref or crash from slab corruption), with theoretical kernel code-execution potential from the UAF path requiring precise heap manipulation. Priority for patching is moderate, but elevated for environments that perform dynamic nfsd module management during active NFS service.

A local administrator on an NFSv3 server executes rmmod nfsd (or a service manager tears down nfsd) while remote NFS clients are actively acquiring or releasing file locks via lockd. The nfsd_lockd_shutdown() plain store clears nlmsvc_ops before an in-flight lockd fopen or fclose callback completes, causing the dispatch path to dereference a NULL or stale pointer into already-unloaded nfsd module text, triggering a kernel panic or slab corruption. No public proof-of-concept exists for this scenario.