CVE-2026-22989

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check that server is running in unlock_filesystem

If we are trying to unlock the filesystem via an administrative

interface and nfsd isn't running, it crashes the server. This

happens currently because nfsd4_revoke_states() access state

structures (eg., conf_id_hashtbl) that has been freed as a part

of the server shutdown.

[ 59.465072] Call trace:

[ 59.465308] nfsd4_revoke_states+0x1b4/0x898 [nfsd] (P)

[ 59.465830] write_unlock_fs+0x258/0x440 [nfsd]

[ 59.466278] nfsctl_transaction_write+0xb0/0x120 [nfsd]

[ 59.466780] vfs_write+0x1f0/0x938

[ 59.467088] ksys_write+0xfc/0x1f8

[ 59.467395] __arm64_sys_write+0x74/0xb8

[ 59.467746] invoke_syscall.constprop.0+0xdc/0x1e8

[ 59.468177] do_el0_svc+0x154/0x1d8

[ 59.468489] el0_svc+0x40/0xe0

[ 59.468767] el0t_64_sync_handler+0xa0/0xe8

[ 59.469138] el0t_64_sync+0x1ac/0x1b0

Ensure this can't happen by taking the nfsd_mutex and checking tha

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References