CVE-2026-89688
A critical flaw in the Linux kernel’s NFS server can cause a use‑after‑free that may crash the system or allow arbitrary code execution. The bug was fixed in the kernel, so newer releases contain the patch.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel NFS server implementations on all versions prior to the fix; users running an NFS server on Linux.
Real-world impact
An attacker who can trigger the flaw could crash the NFS service, causing a denial of service, or potentially execute code with kernel privileges, leading to full system compromise.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability requires no authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade the Linux kernel to the latest available version that includes the fix.
- 02Reboot the system to load the new kernel.
NVD description indicates the vulnerability has been resolved in the Linux kernel
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.