lockd, nfsd: RCU-protect nlmsvc_ops dispatch
Why It Matters
Analysis dossierWhy It Matters
In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.
High
Unknown
Unknown
Risk basis: SOC ecosystem technology relevance; HIGH severity; No confirmed exploitation signal in current enrichment
Affected Products & Remediation
3 source-backed products- azl3 kernel 6.6.150.1-1 on Azure Linux 3.0 · version range not provided by source · Microsoft MSRC · Source
- azl3 kernel 6.6.152.1-1 on Azure Linux 3.0 · version range not provided by source · Microsoft MSRC · Source
- azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 · version range not provided by source · Microsoft MSRC · Source
Vendor or catalog guidance (source)
- Microsoft MSRC: Release Notes
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
No rule-based guidance for this vulnerability class
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- Record status · verification
- UPDATED · NVD API
- CPE
- Unknown
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2026-89709"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel desc