{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  nfsd: don't free session slots that are still in use  nfsd4_sequence() can free the very slot it is currently processing. When the session shrinker has reduced se_target_maxslots below se_fchannel.maxreqs, the shrink path checks three conditions before calling free_session_slots():    1. se_target_maxslots \u003c maxreqs  (shrink was advertised)   2. slot-\u003esl_generation == se_slot_gen  (slot is up-to-date)   3. seq-\u003emaxslots \u003c= se_target_maxslots  (client acknowledges)  However, seq-\u003eslotid is never checked against se_target_maxslots. A client using a slot in the range [se_target_maxslots, maxreqs) can satisfy all three conditions: its slot has the current generation (set by a prior SEQUENCE), and it sends sa_highest_slotid \u003c= se_target_maxslots to acknowledge the reduction.  free_session_slots() then kfrees every slot at index \u003e= se_target_maxslots, including the caller's own slot. The function continues to write sl_seqid, sl_flags, sl_generation, and stores the dangling pointer in cstate-\u003eslot. Later, nfsd4_store_cache_entry() copies up to maxresp_cached bytes of the compound reply into the freed sl_data[] array, corrupting whatever slab object now occupies that address.  Additionally, a concurrent thread processing SEQUENCE on a different high-numbered slot can have its slot freed out from under it. NFSD4_SLOT_INUSE is set under nn-\u003eclient_lock before the lock is released, so any concurrent thread past SEQUENCE will have its slot marked. However, free_session_slots() does not check NFSD4_SLOT_INUSE before freeing.  Fix both problems by:  1. Checking that the current request's slotid is below the shrink     boundary.  2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and     deferring the shrink if any are active.",
  "id": "DEBIAN-CVE-2026-89689",
  "modified": "2026-09-14T08:47:35.688819807Z",
  "published": "2026-09-11T20:19:55.900Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89689"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-89689"
  ]
}