What is CVE-2026-89686?

CVE-2026-89686 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10, affecting Linux kernel versions from 4.0 onward and patched in 6.12.109, 6.18.50, 7.2.4 and others. CVE-2026-89686 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-89686?

CVE-2026-89686 has a CVSS score of 9.8 out of 10, rated Critical severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-89686?

Yes, CVE-2026-89686 has been patched. Fixed versions include 6.12.109, 6.18.50, 7.2.4 and others. If you are running Linux kernel 4.0 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-89686 actively exploited?

CVE-2026-89686 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-89686

Critical

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering the BUG_ON. This race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall. When the first client doesn't respond to the recall, the laundromat revokes it. A concurrent LAYOUTGET from any client using the delegation stateid hits the race window. Fix this by taking fi_lock around the fi_deleg_file read in the SC_TYPE_DELEG path, matching the locking discipline of the find_any_file() arm, and replacing the BUG_ON with a graceful error return that cleans up the partially-initialized layout stateid.

Package Linux Kernel

Published 2026-09-11

Last modified 2026-09-13

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

9.8

out of 10

Critical

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 4.0 and later are affected. Fixed in 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 and their respective stable series.

Affected from

≥ 4.0

Fixed in

✓ 6.12.109 6.12.x ✓ 6.18.50 6.18.x ✓ 7.2.4 7.2.x ✓ 7.3-rc1

References

4 total

Details

CVE ID CVE-2026-89686

Severity Critical

CVSS score 9.8 / 10

CVSS version 3.1

Published 2026-09-11

Modified 2026-09-13

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-89686?

CVE-2026-89686 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10 . It affects Linux kernel versions from 4.0 onward and has been patched in 6.12.109, 6.18.50, 7.2.4 and others. CVE-2026-89686 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-89686?

CVE-2026-89686 has a CVSS score of 9.8 out of 10, rated Critical severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-89686?

Yes. CVE-2026-89686 has been patched. Fixed versions include 6.12.109, 6.18.50, 7.2.4 and others. If you are running Linux kernel 4.0 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-89686 actively exploited?

No. CVE-2026-89686 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.