CVE-2026-89658
A critical flaw in the Linux kernel’s NFSv4.0 revoked‑state cleanup can allow an attacker to trigger a use‑after‑free, potentially leading to arbitrary code execution. The bug occurs when the kernel drops a client lock while another process is still using the client reference. The issue has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, any system running NFSv4.0 that has not applied the latest kernel patch. Typical users are Linux server administrators.
Real-world impact
An attacker could trigger a use‑after‑free that might let them execute arbitrary code with kernel privileges, potentially taking full control of the affected system.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no user interaction, and can compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the fix for CVE-2026-89658.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.