External risk intelligence

Linux Kernel NFSd Frees In-Use Session Slots Corrupting Data.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89689

The vulnerability exists in the Linux kernel nfsd component, which handles Network File System traffic. While NFS servers are often deployed in internal network segments, they are sometimes exposed to the internet or reachable across network boundaries depending on the deployment configuration, making it plausibly reachable in some environments.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability, resolved in the nfsd component, could allow for memory corruption due to improper handling of session slots. This is a critical issue that, if exploited, could lead to severe data integrity and availability impacts.

A memory corruption flaw exists in the Linux kernel.
It affects how the system manages network file system sessions.
Confirm relevance and potential exposure to business systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by interacting with the Network File System (NFS) service, potentially leading to memory corruption. This could be achieved by sending specially crafted requests that manipulate session slot management within the NFS server. Successful exploitation could allow an attacker to gain elevated privileges or cause a denial-of-service.

No special access required.
Triggered by NFS session slot manipulation.
Can lead to memory corruption and DoS.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's NFS server (nfsd) could allow an attacker to corrupt memory used by the NFS server process. This corruption can occur when the server is handling NFSv4 requests, potentially leading to unexpected behavior or crashes.

NFS server session data.
Memory corruption via crafted NFSv4 requests.
Denial of service or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this Linux kernel vulnerability affecting the NFS server component, platform or infrastructure teams responsible for the kernel and NFS services are likely accountable. The first practical step involves identifying all NFS servers, determining their network exposure and criticality, and confirming the owner of each instance to prioritize remediation efforts.

Platform and infrastructure teams own this.
Verify NFS server exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel nfsd component?

The nfsd component is the server-side implementation of the Network File System (NFS) protocol within the Linux kernel. It allows a computer to share files and directories with other systems over a network, enabling remote clients to mount and access these resources as if they were stored locally. It is a fundamental service for file sharing, storage clusters, and distributed computing environments.

How does this CVE-2026-89689 memory corruption occur?

This vulnerability is a Use-After-Free memory flaw. The NFS server can prematurely delete, or 'free,' a data structure responsible for tracking an active network session while the server is still actively using it. Because the server continues to write data to that location, it overwrites memory currently assigned to other tasks, which leads to unpredictable system behavior or data corruption.

Do I need to do anything special to trigger this bug?

Exploitation relies on sending specific, crafted NFSv4 network requests that cause the server to shrink its session slot limit at a precise moment. The bug is not triggered by standard, healthy file operations; it requires a sequence of events where the server attempts to discard session slots while they are still being actively processed or acknowledged by a client.

Is my system at risk if it isn't internet-facing?

Halo Surface Signal notes that while NFS services are often kept on internal networks, they may still be reachable across different network segments. Even if not directly on the internet, any system or user with the ability to communicate with the NFS port can potentially send the malicious requests required to trigger this vulnerability.

When should I prioritize patching this kernel flaw?

You should prioritize this based on the business criticality of your NFS servers. The first step is to inventory all systems running NFS, determine who owns those services, and assess their network reachability. Once identified, coordinate with your infrastructure or platform teams to apply the kernel updates provided by your distribution vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.