{"id":"CVE-2026-89668","summary":"nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()\n\nnfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd().\nIf the slab allocation fails, the bare \"return retval\" bypasses\nnfsd_debugfs_exit(), leaving orphan debugfs files with stale fops\npointers into the freed module text.\n\nMove nfsd_debugfs_init() to after the slab init succeeds, so the\nearly return has no debugfs state to clean up.\n\nSince debugfs is now the more recently initialized of the two, also\nupdate the unwind paths to match reverse-initialization (LIFO) order:\nrun nfsd_debugfs_exit() before nfsd4_free_slabs() in both the\ninit_nfsd() error path and exit_nfsd(). The nfsd debugfs files only\nreference module-global state and have no dependency on the slab\ncaches, so that reordering is a cleanup with no functional change.","modified":"2026-09-13T03:47:20.165638052Z","published":"2026-09-11T19:45:54.354Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89668.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2c390c8a1764d67095fe444401861fac4c049362"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4ae5d7490ae6a7b83b3d607f88c499f4f85e753a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ab43ff94f5dfc2b6a080b167b69855eb7655c98b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89668.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89668"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9fe5ea760e64f04412dbed51645a0dac7220d40a"},{"fixed":"4ae5d7490ae6a7b83b3d607f88c499f4f85e753a"},{"fixed":"ab43ff94f5dfc2b6a080b167b69855eb7655c98b"},{"fixed":"2c390c8a1764d67095fe444401861fac4c049362"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89668.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.16.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89668.json"}}],"schema_version":"1.9.0"}