CVE-2026-89696
UnknownSummary
In the Linux kernel's nfsd module, a flaw allows subsequent operations to run after a FOREIGN PUTFH even when fh_dentry is NULL. A remote NFSv4.2 client can craft a COMPOUND request that triggers a NULL pointer dereference in the nfsd kernel thread. The issue affects configurations with CONFIG_NFSD_V4_2_INTER_SSC enabled.
Risk Assessment
A remote authenticated NFS client can cause a kernel crash (panic) and denial of service on the file server. In environments using NFSv4.2 inter-SSC, the risk is real and requires prompt patching.
Recommendation
Update the Linux kernel to a version containing the nfsd fix (gating the dispatch loop on NFSD4_FH_FOREIGN). If immediate update is not possible, consider disabling CONFIG_NFSD_V4_2_INTER_SSC until the patch is applied.
Other vulnerabilities in Linux kernel (nfsd)
See all- CVE-2026-89706Unknown
In the Linux kernel, the nfsd module failed to reset the write verifier when an async COPY writeback failed. When writeback failed, the server reported NFS_UNSTABLE to the NFS client but did not rotate the verifier, so after COMMIT the client treated the data as durable even though the write had failed.
- CVE-2026-89705Unknown
In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.
- CVE-2026-89704Unknown
In the Linux kernel, _nfsd_copy_file_range() sampled the writeback error cursor (dst->f_wb_err) after the copy loop instead of before it. Concurrent COMMIT or stable WRITE could advance the cursor, so the writeback error went undetected and NFSD4_COPY_F_COMMITTED was set despite the failed write.
- CVE-2026-89703Unknown
In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().
- CVE-2026-89701Unknown
In the Linux kernel, the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms stored a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. A malicious client could send a malformed timespec that propagated through notify_change() to disk.
- CVE-2026-89700Unknown
In the Linux kernel, the nfsd_sock_nl_policy declared NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller could send a 16-byte address with sa_family=AF_INET6, causing a 12-byte out-of-bounds read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind).
- CVE-2026-89699Unknown
In the Linux kernel, nfsd4_decode_create() accepted an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op. The VFS rejected oversized targets with ENAMETOOLONG, but the allocation had already occurred.
- CVE-2026-89698Unknown
In the Linux kernel, struct nfsd_genl_rqstp declared rq_daddr and rq_saddr as plain struct sockaddr (16 bytes). With an IPv6 NFS client connected, nfsd_genl_rpc_status_compose_msg() cast these fields to struct sockaddr_in6 (28 bytes), reading 8 bytes past the field and shipping a truncated IPv6 address plus part of rq_flags to userspace via netlink.
- CVE-2026-89697Unknown
In the Linux kernel, the BOTH_TIME_SET branch in nfsd_proc_setattr() called fh_verify() early so setattr_prepare() could inspect the dentry. This caused nfsd_setattr() to skip fh_want_write(), so notify_change() ran without a mount write reference.
- CVE-2026-89695Unknown
In the Linux kernel's nfsd module, nfsd4_decode_posixacl() accepts an unbounded ACL entry count from the client and passes it to an O(n^2) bubble sort. A client can choose an arbitrarily large value, causing excessive CPU consumption on the server. The symmetric NFS_ACL_MAX_ENTRIES check present on the encoder side is missing in the decoder.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh_export both NULL if fh_verify() returns nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag is set, but the compound dispatch loop only uses this flag to bypass the nfserr_nofilehandle check -- it does not prevent subsequent ops from running with a NULL fh_dentry. A remote client can exploit this by crafting a COMPOUND that includes an inter-SSC COPY (which causes check_if_stalefh_allowed() to set no_verify=true on the saved PUTFH) with an additional op inserted between the source PUTFH and SAVEFH. For example, SETATTR calls fh_want_write() which dereferences fh_export->ex_path.mnt without calling fh_verify() first, causing a NULL pointer dereference in the nfsd kthread. Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow) and ops with ALLOWED_WITHOUT_FH (which don't need a resolved filehandle) may proceed. All other ops receive nfserr_stale, per RFC 7862 Section 15.2.3 which specifies that foreign filehandle validation is deferred to the consuming operation and NFS4ERR_STALE returned at that point.