CVE-2026-89667: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

The shrinker, GC worker, and fsnotify/lease callbacks can unhash an
nfsd_file from the rhashtable and then call
nfsd_file_dispose_list_delayed() to move it to the per-net dispose list.
If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk
misses the already-unhashed file, and its drain of the per-net dispose
list can run before the file has been queued.  The file then sits on
the per-net list with no thread to drain it, leaking both the file and
its associated state.

The GC worker and shrinker already hold nfsd_gc_lock while walking the
LRU, but in the original code they release it before calling
nfsd_file_dispose_list_delayed().  The fsnotify/lease path
(nfsd_file_close_inode) has no synchronization at all.

Fix this by:

  1. Widening nfsd_gc_lock in both nfsd_file_gc() and nfsd_file_lru_scan()
     to cover the nfsd_file_dispose_list_delayed() call.

  2. Wrapping nfsd_file_close_inode() in nfsd_gc_lock so that all three
     callers of nfsd_file_dispose_list_delayed() hold the lock.

  3. Adding a spin_lock/unlock(nfsd_gc_lock) barrier in
     nfsd_file_cache_shutdown_net() after the purge, so that any
     in-progress disposal has fully completed before the per-net list
     is drained.

All operations inside the lock are non-sleeping (rhashtable lookups,
atomic bit/refcount ops, list moves, svc_wake_up), so the spinlock is
appropriate.

The Linux kernel CVE team has assigned CVE-2026-89667 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.9 with commit ffb402596147ac583f3464ff5c48feb9423e3838 and fixed in 6.18.51 with commit 6d6b9f6a75c3767250e9c23ace4e384ab8f7843e
	Issue introduced in 6.9 with commit ffb402596147ac583f3464ff5c48feb9423e3838 and fixed in 7.2.4 with commit 08af9593e2b472fd98c00faf1bf03bdbb7203477
	Issue introduced in 6.9 with commit ffb402596147ac583f3464ff5c48feb9423e3838 and fixed in 7.3-rc1 with commit 40162cfea79b9510380decfdd1795b754dc9f972

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89667
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfsd/filecache.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6d6b9f6a75c3767250e9c23ace4e384ab8f7843e
	https://git.kernel.org/stable/c/08af9593e2b472fd98c00faf1bf03bdbb7203477
	https://git.kernel.org/stable/c/40162cfea79b9510380decfdd1795b754dc9f972