CVE-2026-89668

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

nfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd(). If the slab allocation fails, the bare "return retval" bypasses nfsd_debugfs_exit(), leaving orphan debugfs files with stale fops pointers into the freed module text.

Move nfsd_debugfs_init() to after the slab init succeeds, so the early return has no debugfs state to clean up.

Since debugfs is now the more recently initialized of the two, also update the unwind paths to match reverse-initialization (LIFO) order: run nfsd_debugfs_exit() before nfsd4_free_slabs() in both the init_nfsd() error path and exit_nfsd().

Leer descripción completaMostrar menos

The nfsd debugfs files only reference module-global state and have no dependency on the slab caches, so that reordering is a cleanup with no functional change.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.18%
Percentil entre todas las CVEs puntuadas: 7
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1005 Data from Local Systemcollection75 %
Impacto secundarioT1499.004 Application or System Exploitationimpact70 %

Vulnerabilidad de kernel Linux con acceso local (AV:L/PR:L) que permite lectura y corrupción de memoria mediante punteros stale en debugfs tras fallo de asignación de slabs.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Filter Network Traffic Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-89668",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "9fe5ea760e64f04412dbed51645a0dac7220d40a",
              "lessThan": "4ae5d7490ae6a7b83b3d607f88c499f4f85e753a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9fe5ea760e64f04412dbed51645a0dac7220d40a",
              "lessThan": "ab43ff94f5dfc2b6a080b167b69855eb7655c98b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9fe5ea760e64f04412dbed51645a0dac7220d40a",
              "lessThan": "2c390c8a1764d67095fe444401861fac4c049362",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/nfsd/nfsctl.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/nfsd/nfsctl.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:53.290",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2c390c8a1764d67095fe444401861fac4c049362",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4ae5d7490ae6a7b83b3d607f88c499f4f85e753a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ab43ff94f5dfc2b6a080b167b69855eb7655c98b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()\n\nnfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd().\nIf the slab allocation fails, the bare \"return retval\" bypasses\nnfsd_debugfs_exit(), leaving orphan debugfs files with stale fops\npointers into the freed module text.\n\nMove nfsd_debugfs_init() to after the slab init succeeds, so the\nearly return has no debugfs state to clean up.\n\nSince debugfs is now the more recently initialized of the two, also\nupdate the unwind paths to match reverse-initialization (LIFO) order:\nrun nfsd_debugfs_exit() before nfsd4_free_slabs() in both the\ninit_nfsd() error path and exit_nfsd(). The nfsd debugfs files only\nreference module-global state and have no dependency on the slab\ncaches, so that reordering is a cleanup with no functional change."
    }
  ],
  "lastModified": "2026-09-13T07:17:32.423",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}