CVE-2026-89709: lockd, nfsd: RCU-protect nlmsvc_ops dispatch
In the Linux kernel, the following vulnerability has been resolved:
lockd, nfsd: RCU-protect nlmsvcops dispatch
nlmsvcops is published by nfsdlockdinit() and cleared by nfsdlockdshutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free.
Declare nlmsvcops as rcu, publish via rcuassignpointer(), clear via RCUINITPOINTER() + synchronizercu(). Add a struct module owner field to nlmsvcbinding and pin the module across indirect calls with trymoduleget/moduleput. When the binding is torn down, fall back to fput() to avoid leaking struct file references.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel with both lockd and nfsd involved are exposed when nfsd's lockd integration is initialized and nfsd can subsequently be unloaded. The failure occurs when lockd dispatches through a stale nlmsvc_ops pointer after nfsd module removal.
What conditions are needed to trigger the vulnerability?
The relevant condition is a race between lockd dispatch activity and nfsd shutdown or module removal. A stale pointer can lead to a NULL dereference or an indirect call into nfsd module text after that module has been unloaded.
How can I tell whether a system may already be affected?
Look for kernel crashes consistent with a NULL pointer dereference or use-after-free involving lockd dispatch paths during or after removal of the nfsd module. The described stale pointer is nlmsvc_ops, and the affected dispatch code is in fs/lockd/svcsubs.c.
What does the fix change?
The fix RCU-protects publication and clearing of nlmsvc_ops, waits for active readers during teardown, and pins the owning module around indirect callback calls. It also uses fput() when a binding is torn down to avoid leaking struct file references.