{"api_version":"1","generated_at":"2026-09-11T22:32:25+00:00","cve":"CVE-2026-89668","urls":{"html":"https://cve.report/CVE-2026-89668","api":"https://cve.report/api/cve/CVE-2026-89668.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89668","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89668"},"summary":{"title":"nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()\n\nnfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd().\nIf the slab allocation fails, the bare \"return retval\" bypasses\nnfsd_debugfs_exit(), leaving orphan debugfs files with stale fops\npointers into the freed module text.\n\nMove nfsd_debugfs_init() to after the slab init succeeds, so the\nearly return has no debugfs state to clean up.\n\nSince debugfs is now the more recently initialized of the two, also\nupdate the unwind paths to match reverse-initialization (LIFO) order:\nrun nfsd_debugfs_exit() before nfsd4_free_slabs() in both the\ninit_nfsd() error path and exit_nfsd(). The nfsd debugfs files only\nreference module-global state and have no dependency on the slab\ncaches, so that reordering is a cleanup with no functional change.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:53","updated_at":"2026-09-11 20:19:53"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/4ae5d7490ae6a7b83b3d607f88c499f4f85e753a","name":"https://git.kernel.org/stable/c/4ae5d7490ae6a7b83b3d607f88c499f4f85e753a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2c390c8a1764d67095fe444401861fac4c049362","name":"https://git.kernel.org/stable/c/2c390c8a1764d67095fe444401861fac4c049362","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ab43ff94f5dfc2b6a080b167b69855eb7655c98b","name":"https://git.kernel.org/stable/c/ab43ff94f5dfc2b6a080b167b69855eb7655c98b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89668","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89668","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9fe5ea760e64f04412dbed51645a0dac7220d40a 4ae5d7490ae6a7b83b3d607f88c499f4f85e753a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9fe5ea760e64f04412dbed51645a0dac7220d40a ab43ff94f5dfc2b6a080b167b69855eb7655c98b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9fe5ea760e64f04412dbed51645a0dac7220d40a 2c390c8a1764d67095fe444401861fac4c049362 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4ae5d7490ae6a7b83b3d607f88c499f4f85e753a","status":"affected","version":"9fe5ea760e64f04412dbed51645a0dac7220d40a","versionType":"git"},{"lessThan":"ab43ff94f5dfc2b6a080b167b69855eb7655c98b","status":"affected","version":"9fe5ea760e64f04412dbed51645a0dac7220d40a","versionType":"git"},{"lessThan":"2c390c8a1764d67095fe444401861fac4c049362","status":"affected","version":"9fe5ea760e64f04412dbed51645a0dac7220d40a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"6.16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()\n\nnfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd().\nIf the slab allocation fails, the bare \"return retval\" bypasses\nnfsd_debugfs_exit(), leaving orphan debugfs files with stale fops\npointers into the freed module text.\n\nMove nfsd_debugfs_init() to after the slab init succeeds, so the\nearly return has no debugfs state to clean up.\n\nSince debugfs is now the more recently initialized of the two, also\nupdate the unwind paths to match reverse-initialization (LIFO) order:\nrun nfsd_debugfs_exit() before nfsd4_free_slabs() in both the\ninit_nfsd() error path and exit_nfsd(). The nfsd debugfs files only\nreference module-global state and have no dependency on the slab\ncaches, so that reordering is a cleanup with no functional change."}],"providerMetadata":{"dateUpdated":"2026-09-11T19:45:54.354Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/4ae5d7490ae6a7b83b3d607f88c499f4f85e753a"},{"url":"https://git.kernel.org/stable/c/ab43ff94f5dfc2b6a080b167b69855eb7655c98b"},{"url":"https://git.kernel.org/stable/c/2c390c8a1764d67095fe444401861fac4c049362"}],"title":"nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89668","datePublished":"2026-09-11T19:45:54.354Z","dateReserved":"2026-09-11T19:38:34.745Z","dateUpdated":"2026-09-11T19:45:54.354Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:53","lastModifiedDate":"2026-09-11 20:19:53","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89668","Ordinal":"1","Title":"nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_","CVE":"CVE-2026-89668","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89668","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()\n\nnfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd().\nIf the slab allocation fails, the bare \"return retval\" bypasses\nnfsd_debugfs_exit(), leaving orphan debugfs files with stale fops\npointers into the freed module text.\n\nMove nfsd_debugfs_init() to after the slab init succeeds, so the\nearly return has no debugfs state to clean up.\n\nSince debugfs is now the more recently initialized of the two, also\nupdate the unwind paths to match reverse-initialization (LIFO) order:\nrun nfsd_debugfs_exit() before nfsd4_free_slabs() in both the\ninit_nfsd() error path and exit_nfsd(). The nfsd debugfs files only\nreference module-global state and have no dependency on the slab\ncaches, so that reordering is a cleanup with no functional change.","Type":"Description","Title":"nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_"}]}}}