UBUNTU-CVE-2026-89670: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu (filecache.c:296), and nfsdfileslab is created without SLABTYPESAFEBYRCU (KMEMCACHE(nfsdfile, 0) at filecache.c:789), so the slab page backing a freed nfsdfile becomes freely reclaimable once the RCU grace period elapses. The again: retry block in nfsdopenlocalfh() loads a pointer with cmpxchg and then calls nfsdfileget(new) (which is refcountincnotzero) without holding rcureadlock. The sole caller nfsopenlocalfh() drops rcureadlock before invoking this helper, so no outer reader-side critical section covers the load. CPU 0 (nfsdopenlocalfh) CPU 1 (nfsdfileputlocal) ----- ----- new = cmpxchg(pnf, NULL, ...) nf = xchg(pnf, NULL) nfsdfileput(nf) last ref -> callrcu() / grace period elapses; slab page recycled / nfsdfileget(new) refcountincnotzero(&new->nfref) / operates on recycled memory / A non-zero word at the nfref offset of the recycled object makes the refcount bump appear to succeed, and the caller then dereferences new->nfnet and new->nffile out of freed memory. Fix by taking rcureadlock() immediately before the cmpxchg and releasing it on all three exits of the if (new) block: the goto-again retry, the lost-race cleanup path, and the install-succeeded path. nfsdfileput() and nfsdnetput() stay outside the RCU section so they remain free to block.