CVE-2026-22989
- Source
- https://cve.org/CVERecord?id=CVE-2026-22989
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22989.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-22989
- Downstream
- Published
- 2026-01-23T15:24:10.523Z
- Modified
- 2026-02-09T19:36:03.782158Z
- Summary
- nfsd: check that server is running in unlock_filesystem
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nfsd: check that server is running in unlock_filesystem
If we are trying to unlock the filesystem via an administrative interface and nfsd isn't running, it crashes the server. This happens currently because nfsd4revokestates() access state structures (eg., confidhashtbl) that has been freed as a part of the server shutdown.
[ 59.465072] Call trace: [ 59.465308] nfsd4revokestates+0x1b4/0x898 [nfsd] (P) [ 59.465830] writeunlockfs+0x258/0x440 [nfsd] [ 59.466278] nfsctltransactionwrite+0xb0/0x120 [nfsd] [ 59.466780] vfswrite+0x1f0/0x938 [ 59.467088] ksyswrite+0xfc/0x1f8 [ 59.467395] _arm64syswrite+0x74/0xb8 [ 59.467746] invokesyscall.constprop.0+0xdc/0x1e8 [ 59.468177] doel0svc+0x154/0x1d8 [ 59.468489] el0svc+0x40/0xe0 [ 59.468767] el0t64synchandler+0xa0/0xe8 [ 59.469138] el0t64sync+0x1ac/0x1b0
Ensure this can't happen by taking the nfsdmutex and checking that the server is still up, and then holding the mutex across the call to nfsd4revoke_states().
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22989.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/d0424066fcd294977f310964bed6f2a487fa4515
- https://git.kernel.org/stable/c/d95499900fe52f3d461ed26b7a30bebea8f12914
- https://git.kernel.org/stable/c/e06c9f6c0f554148d4921c2a15bd054260a054ac
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22989.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-22989
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1ac3629bf012592cb0320e52a1cceb319a05ad17Fixedd95499900fe52f3d461ed26b7a30bebea8f12914Fixede06c9f6c0f554148d4921c2a15bd054260a054acFixedd0424066fcd294977f310964bed6f2a487fa4515