CVE-2026-22989: nfsd: check that server is running in unlock_filesystem
In the Linux kernel, the following vulnerability has been resolved:
nfsd: check that server is running in unlockfilesystem
If we are trying to unlock the filesystem via an administrative interface and nfsd isn't running, it crashes the server. This happens currently because nfsd4revokestates() access state structures (eg., confidhashtbl) that has been freed as a part of the server shutdown.
[ 59.465072] Call trace: [ 59.465308] nfsd4revokestates+0x1b4/0x898 [nfsd] (P) [ 59.465830] writeunlockfs+0x258/0x440 [nfsd] [ 59.466278] nfsctltransactionwrite+0xb0/0x120 [nfsd] [ 59.466780] vfswrite+0x1f0/0x938 [ 59.467088] ksyswrite+0xfc/0x1f8 [ 59.467395] arm64syswrite+0x74/0xb8 [ 59.467746] invokesyscall.constprop.0+0xdc/0x1e8 [ 59.468177] doel0svc+0x154/0x1d8 [ 59.468489] el0svc+0x40/0xe0 [ 59.468767] el0t64synchandler+0xa0/0xe8 [ 59.469138] el0t64sync+0x1ac/0x1b0
Ensure this can't happen by taking the nfsdmutex and checking that the server is still up, and then holding the mutex across the call to nfsd4revokestates().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the nfsd filesystem-unlock path, take nfsd_mutex, check that the nfsd server is still running, and hold the mutex across the call to nfsd4_revoke_states().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22989?
CVE-2026-22989 is categorized as a high severity vulnerability due to its potential to crash the server.
How do I fix CVE-2026-22989?
To fix CVE-2026-22989, ensure that the nfsd service is running before attempting to unlock the filesystem.
What impact does CVE-2026-22989 have on system performance?
CVE-2026-22989 can lead to system crashes, affecting availability and stability.
Which versions of the Linux Kernel are affected by CVE-2026-22989?
CVE-2026-22989 affects various versions of the Linux Kernel without specific version exclusions.
Is CVE-2026-22989 related to filesystem management?
Yes, CVE-2026-22989 is related to filesystem management and how nfsd interacts with the filesystem during unlock operations.