CVE-2026-89668: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: move nfsddebugfsinit() after nfsd4initslabs() in initnfsd()
nfsddebugfsinit() runs before nfsd4initslabs() in initnfsd(). If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit(), leaving orphan debugfs files with stale fops pointers into the freed module text.
Move nfsddebugfsinit() to after the slab init succeeds, so the early return has no debugfs state to clean up.
Since debugfs is now the more recently initialized of the two, also update the unwind paths to match reverse-initialization (LIFO) order: run nfsddebugfsexit() before nfsd4freeslabs() in both the initnfsd() error path and exitnfsd(). The nfsd debugfs files only reference module-global state and have no dependency on the slab caches, so that reordering is a cleanup with no functional change.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel nfsd initialization code, call nfsd_debugfs_init() only after nfsd4_init_slabs() succeeds, and call nfsd_debugfs_exit() before nfsd4_free_slabs() in both the init_nfsd() error path and exit_nfsd() so cleanup follows reverse-initialization order.
Event History
Frequently Asked Questions
Under what conditions can stale debugfs file operations be left behind?
The condition occurs when nfsd debugfs initialization has run and the subsequent NFSv4 slab allocation fails during nfsd initialization. The early error return then bypasses debugfs cleanup, leaving debugfs files with file-operation pointers into freed module text.
Who is realistically exposed to this issue?
Systems that initialize the kernel NFS server component and encounter failure of the NFSv4 slab allocation after debugfs setup are exposed. The provided information does not identify a remote trigger or a specific attacker capability.
How does the fix prevent the stale debugfs entries?
It initializes nfsd debugfs only after NFSv4 slab initialization succeeds, so a slab-init failure cannot leave debugfs state behind. It also changes error and module-exit cleanup to remove debugfs before freeing the slab caches.