{
  "cveId": "CVE-2026-89670",
  "url": "https://patchblox.com/security/cve/CVE-2026-89670",
  "summary": "CVE-2026-89670 is fixed in linux on 1 platform by DEBIAN-CVE-2026-89670 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: hold rcu across localio cmpxchg retry  nfs...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  nfsd: hold rcu across localio cmpxchg retry  nfsd_file objects are freed via call_rcu (filecache.c:296), and nfsd_file_slab is created without SLAB_TYPESAFE_BY_RCU (KMEM_CACHE(nfsd_file, 0) at filecache.c:789), so the slab page backing a freed nfsd_file becomes freely reclaimable once the RCU grace period elapses.  The again: retry block in nfsd_open_local_fh() loads a pointer with cmpxchg and then calls nfsd_file_get(new) (which is refcount_inc_not_zero) without holding rcu_read_lock. The sole caller nfs_open_local_fh() drops rcu_read_lock before invoking this helper, so no outer reader-side critical section covers the load.      CPU 0 (nfsd_open_local_fh)        CPU 1 (nfsd_file_put_local)     -----                             -----     new = cmpxchg(pnf, NULL, ...)                                       nf = xchg(pnf, NULL)                                       nfsd_file_put(nf)                                         last ref -\u003E call_rcu()                                       /* grace period elapses;                                          slab page recycled */     nfsd_file_get(new)       refcount_inc_not_zero(\u0026new-\u003Enf_ref)       /* operates on recycled memory */  A non-zero word at the nf_ref offset of the recycled object makes the refcount bump appear to succeed, and the caller then dereferences new-\u003Enf_net and new-\u003Enf_file out of freed memory.  Fix by taking rcu_read_lock() immediately before the cmpxchg and releasing it on all three exits of the if (new) block: the goto-again retry, the lost-race cleanup path, and the install-succeeded path. nfsd_file_put() and nfsd_net_put() stay outside the RCU section so they remain free to block.",
  "published": "2026-09-11T20:19:53Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00173,
  "epssPercentile": 0.06814,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-89670",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89670",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}