What is CVE-2026-89690?

CVE-2026-89690 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 6.7 onward and patched in 6.12.109, 6.18.50, 7.2.4 and others. CVE-2026-89690 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-89690?

CVE-2026-89690 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-89690?

Yes, CVE-2026-89690 has been patched. Fixed versions include 6.12.109, 6.18.50, 7.2.4 and others. If you are running Linux kernel 6.7 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-89690 actively exploited?

CVE-2026-89690 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-89690

High

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4_release_compoundargs() at the end of every compound. The dumpit's rcu_read_lock pins the svc_rqst struct itself (freed via kfree_rcu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory. The trailing seqcount recheck (smp_load_acquire of rq_status_counter) cannot undo a load that already retired against freed memory. Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which defers the free until after an RCU grace period. This makes the existing rcu_read_lock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 * sizeof(struct nfsd4_op)) persist in memory slightly longer, across one grace period, before being reclaimed.

Package Linux Kernel

Published 2026-09-11

Last modified 2026-09-13

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 6.7 and later are affected. Fixed in 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 and their respective stable series.

Affected from

≥ 6.7

Fixed in

✓ 6.12.109 6.12.x ✓ 6.18.50 6.18.x ✓ 7.2.4 7.2.x ✓ 7.3-rc1

References

4 total

Details

CVE ID CVE-2026-89690

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-09-11

Modified 2026-09-13

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-89690?

CVE-2026-89690 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 6.7 onward and has been patched in 6.12.109, 6.18.50, 7.2.4 and others. CVE-2026-89690 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-89690?

CVE-2026-89690 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-89690?

Yes. CVE-2026-89690 has been patched. Fixed versions include 6.12.109, 6.18.50, 7.2.4 and others. If you are running Linux kernel 6.7 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-89690 actively exploited?

No. CVE-2026-89690 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.