{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-89661",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-89661",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-11T19:45:49.086Z",
    "updatedAt": "2026-10-19T08:50:32.806Z",
    "importedAt": "2026-10-24T01:58:35.090Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "NFSD: Prevent post-shutdown use-after-free in unlock_filesystem",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent post-shutdown use-after-free in unlock_filesystem\n\nWriting a filesystem path to /proc/fs/nfsd/unlock_filesystem runs\nnfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the\nhandler confirms that nn->nfsd_serv is set. Once nfsd has shut down,\nnfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the\npointer intact, so the cancel helper iterates freed slab memory as an\narray of struct list_head and then dereferences a bogus nfs4_client\nwhen it takes clp->async_lock. A local administrator holding\nCAP_SYS_ADMIN can reach this use-after-free by stopping the server and\nthen writing to unlock_filesystem; KASAN reports a slab-use-after-free\nread in nfsd4_cancel_copy_by_sb().\n\nnfsd4_revoke_states() walks the same state tables and for that reason\nalready runs only under nfsd_mutex with nn->nfsd_serv confirmed\npresent. Move the async COPY cancel into that protected section so\nevery NFSv4 state-table walker on this path observes a running server.\nAsync copies exist only while the server runs, so gating the cancel on\nnn->nfsd_serv loses nothing.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3daab3112f039cf849f96764019b096bb0a39d04",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0c1a755b7212e0835398d4df5e782ea85ccd7476"
            },
            {
              "version": "3daab3112f039cf849f96764019b096bb0a39d04",
              "status": "affected",
              "versionType": "git",
              "lessThan": "292d915d3ba6fd15eeb88351fa10581683073109"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "7.0",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "7.0"
            },
            {
              "version": "7.2.4",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}