External risk intelligence

Linux Kernel NFSD Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89712

This vulnerability exists within the Linux kernel NFSD (NFS server) subsystem's internal memory management logic related to mount expiration. It is a low-level kernel code execution path not directly exposed as an internet-facing service or application, and it requires specific internal kernel state to be triggered.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Linux kernel, specifically within the NFS server (NFSD) component. This issue could potentially allow for unauthorized access and manipulation of data by an attacker. The main concern at this time is confirming the relevance and exposure of this vulnerability to our environment.

Kernel vulnerability impacts NFS server internal operations.
Understand its potential impact on data integrity.
Confirm relevance and assess exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a flaw in the Linux kernel's NFS server by triggering a race condition during mount expiration. This race condition occurs when one thread is iterating through a list of mounts while another thread attempts to remove an item from the same list. If the removal happens at a critical moment, the first thread might try to access an already freed item, potentially leading to a system crash or memory corruption.

Entry condition: Attacker gains access to trigger specific NFS server operations.
Trigger point: Race condition during mount expiration and list iteration.
Resulting risk: System instability or memory corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's NFS server could potentially lead to a crash or instability. It arises when handling the expiration of unmounted NFS server mounts, specifically during a race condition where a list iteration pointer might become invalid after a lock is released. This could affect the reliability of NFS services when dealing with specific unmounting scenarios.

NFS server mount expiration data.
Race condition during lock release.
Service instability or crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Linux kernel's NFS server (NFSD) affects the management of inter-server mount expirations. Responsibility likely falls to the infrastructure or platform teams managing the Linux kernel and NFS services, in coordination with security and vendor management if third-party NFS solutions are in use. The first practical step is to identify all systems running the affected kernel version, confirm if they are exposed to relevant network traffic, and determine their business criticality before planning remediation.

Kernel and NFS infrastructure teams own this.
Verify affected kernel instances and exposure.
Plan staged kernel updates and reboots.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NFSD component?

NFSD is the server-side software within the Linux kernel that handles Network File System requests. It allows a computer to share its file system with other devices over a network, enabling remote users to mount and access directories as if they were local storage.

What is the vulnerability behind CVE-2026-89712?

This is a use-after-free vulnerability, which is a memory management flaw. It happens when the system tries to use a piece of computer memory after it has already been cleared or deleted. In this case, the NFS server incorrectly retains a pointer to a list item that another process has already removed, potentially causing memory corruption or system crashes.

How can this vulnerability be triggered?

An attacker needs to interact with the NFS server to trigger specific mount expiration tasks. The flaw occurs during a race condition where one thread is busy managing mount entries while another thread removes one. It is not triggered by standard, routine file access; it requires the precise timing of internal kernel operations during the unmounting process.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this issue is very unlikely to be reachable from the internet. The vulnerability resides deep within the internal memory management of the kernel's NFS subsystem. Because it is not a high-level application service, it is not typically exposed directly to external network traffic in a way that allows for easy remote exploitation.

What should I do if I run systems with this kernel?

First, identify which of your servers are actively running the affected Linux kernel versions and providing NFS services. Since this requires a kernel-level change, coordinate with your infrastructure or platform teams to plan for a routine system update and reboot as part of your standard maintenance lifecycle to incorporate the official software patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.