CVE-2026-22989

nfsd: check that server is running in unlock_filesystem

published January 23, 2026

CVSS
—
EPSS
0%
Percentile
2.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check that server is running in unlock_filesystem

If we are trying to unlock the filesystem via an administrative

interface and nfsd isn't running, it crashes the server. This

happens currently because nfsd4_revoke_states() access state

structures (eg., conf_id_hashtbl) that has been freed as a part

of the server shutdown.

[ 59.465072] Call trace:

[ 59.465308] nfsd4_revoke_states+0x1b4/0x898 [nfsd] (P)

[ 59.465830] write_unlock_fs+0x258/0x440 [nfsd]

[ 59.466278] nfsctl_transaction_write+0xb0/0x120 [nfsd]

[ 59.466780] vfs_write+0x1f0/0x938

[ 59.467088] ksys_write+0xfc/0x1f8

[ 59.467395] __arm64_sys_write+0x74/0xb8

[ 59.467746] invoke_syscall.constprop.0+0xdc/0x1e8

[ 59.468177] do_el0_svc+0x154/0x1d8

[ 59.468489] el0_svc+0x40/0xe0

[ 59.468767] el0t_64_sync_handler+0xa0/0xe8

[ 59.469138] el0t_64_sync+0x1ac/0x1b0

Ensure this can't happen by taking the nfsd_mutex and checking that

the server is still up, and then holding the mutex across the call to

nfsd4_revoke_states().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00135 · 2.7th percentile
Published
2026-01-23T15:24Z
EPSS history
Timeline
  • 23 JAN 15:24Z
    nfsd: check that server is running in unlock_filesystem
    cvelistv5