{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent post-shutdown use-after-free in unlock_filesystem  Writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the handler confirms that nn-\u003enfsd_serv is set. Once nfsd has shut down, nfs4_state_destroy_net() has freed nn-\u003econf_id_hashtbl but left the pointer intact, so the cancel helper iterates freed slab memory as an array of struct list_head and then dereferences a bogus nfs4_client when it takes clp-\u003easync_lock. A local administrator holding CAP_SYS_ADMIN can reach this use-after-free by stopping the server and then writing to unlock_filesystem; KASAN reports a slab-use-after-free read in nfsd4_cancel_copy_by_sb().  nfsd4_revoke_states() walks the same state tables and for that reason already runs only under nfsd_mutex with nn-\u003enfsd_serv confirmed present. Move the async COPY cancel into that protected section so every NFSv4 state-table walker on this path observes a running server. Async copies exist only while the server runs, so gating the cancel on nn-\u003enfsd_serv loses nothing.",
  "id": "DEBIAN-CVE-2026-89661",
  "modified": "2026-09-12T08:47:22.111862424Z",
  "published": "2026-09-11T20:19:52.413Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89661"
    }
  ],
  "upstream": [
    "CVE-2026-89661"
  ]
}