# CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown

> A use-after-free in the Linux kernel NFS server allows attackers to cause a denial of service via a NULL dereference during client teardown.

- **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 11 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-100374, BELL-CVE-2026-89662, DEBIAN-CVE-2026-89662, GHSA-h9v2-7c48-mpxj, UBUNTU-CVE-2026-89662

## What is CVE-2026-89662?

CVE-2026-89662 is a critical use after free vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent lock owner use-after-free during client teardown

__destroy_client() releases a client's open owners, but a lock owner
whose only reference is a blocked lock (nbl) stays on
cl_ownerstr_hashtbl.  client_has_state() does not count a bare owner,
so DESTROY_CLIENTID can reach __destroy_client() with such owners
present.

__destroy_client() then walks the table, calling remove_blocked_locks()
on each owner without a reference.  Freeing a blocked lock drops the
owner reference held via flc_owner.  The per-net laundromat reaps
blocked locks from nn->blocked_locks_lru independently of client state.
The two paths share blocked_locks_lock only for the list splice, not
the owner's lifetime.  The laundromat therefore frees the owner as
__destroy_client() dereferences it, a NULL dereference in
remove_blocked_locks().

nfsd4_release_lockowner() holds a reference across the same call;
__destroy_client() does not.  Hold cl_lock across the walk, taking a
reference and unhashing each owner, then drop it before
remove_blocked_locks() and nfs4_put_stateowner(), which take
blocked_locks_lock and cl_lock.

## Which versions are affected by CVE-2026-89662?


## How do I fix CVE-2026-89662?

Apply the vendor's patch.

## Is CVE-2026-89662 being exploited?

There is no known exploitation of CVE-2026-89662 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-89662 and fix it if it is affected.

What it is: CVE-2026-89662 is a critical use after free vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-89662 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-89662/ (Markdown: https://insights.sbomify.com/CVE-2026-89662/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-89662
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89662
- OSV: https://osv.dev/vulnerability/CVE-2026-89662

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-89662/
Summaries are generated and may contain mistakes; the official description above is the record.