CVE-2026-89705
UnknownSummary
In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.
Risk Assessment
A potential out-of-bounds read by the lockless reader, which may lead to data disclosure or a kernel crash. The vulnerability affects the RPC status mechanism in nfsd.
Recommendation
Update the Linux kernel to a version with the fix that adds a helper advancing the counter to the next even value on every return path following the odd-valued store.
Other vulnerabilities in Linux kernel (nfsd)
See all- CVE-2026-89706Unknown
In the Linux kernel, the nfsd module failed to reset the write verifier when an async COPY writeback failed. When writeback failed, the server reported NFS_UNSTABLE to the NFS client but did not rotate the verifier, so after COMMIT the client treated the data as durable even though the write had failed.
- CVE-2026-89704Unknown
In the Linux kernel, _nfsd_copy_file_range() sampled the writeback error cursor (dst->f_wb_err) after the copy loop instead of before it. Concurrent COMMIT or stable WRITE could advance the cursor, so the writeback error went undetected and NFSD4_COPY_F_COMMITTED was set despite the failed write.
- CVE-2026-89703Unknown
In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().
- CVE-2026-89701Unknown
In the Linux kernel, the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms stored a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. A malicious client could send a malformed timespec that propagated through notify_change() to disk.
- CVE-2026-89700Unknown
In the Linux kernel, the nfsd_sock_nl_policy declared NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller could send a 16-byte address with sa_family=AF_INET6, causing a 12-byte out-of-bounds read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind).
- CVE-2026-89699Unknown
In the Linux kernel, nfsd4_decode_create() accepted an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op. The VFS rejected oversized targets with ENAMETOOLONG, but the allocation had already occurred.
- CVE-2026-89698Unknown
In the Linux kernel, struct nfsd_genl_rqstp declared rq_daddr and rq_saddr as plain struct sockaddr (16 bytes). With an IPv6 NFS client connected, nfsd_genl_rpc_status_compose_msg() cast these fields to struct sockaddr_in6 (28 bytes), reading 8 bytes past the field and shipping a truncated IPv6 address plus part of rq_flags to userspace via netlink.
- CVE-2026-89697Unknown
In the Linux kernel, the BOTH_TIME_SET branch in nfsd_proc_setattr() called fh_verify() early so setattr_prepare() could inspect the dentry. This caused nfsd_setattr() to skip fh_want_write(), so notify_change() ran without a mount write reference.
- CVE-2026-89696Unknown
In the Linux kernel's nfsd module, a flaw allows subsequent operations to run after a FOREIGN PUTFH even when fh_dentry is NULL. A remote NFSv4.2 client can craft a COMPOUND request that triggers a NULL pointer dereference in the nfsd kernel thread. The issue affects configurations with CONFIG_NFSD_V4_2_INTER_SSC enabled.
- CVE-2026-89695Unknown
In the Linux kernel's nfsd module, nfsd4_decode_posixacl() accepts an unbounded ACL entry count from the client and passes it to an O(n^2) bubble sort. A client can choose an arbitrarily large value, causing excessive CPU consumption on the server. The symmetric NFS_ACL_MAX_ENTRIES check present on the encoder side is missing in the decoder.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch() sets rq_status_counter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-lock like protocol with the lockless reader in nfsd_nl_rpc_status_get_dumpit(). Only the fully successful path restored the counter to even. The cache-hit (RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return after the odd-valued store without ever bringing the counter back to even. Once one of those paths is taken, rq_status_counter is left odd: the next request's decode ORs in 1 (still odd) and only a subsequent successful encode restores even. While stuck odd, the dumpit reader treats the rqstp fields as stable and its retry check compares against the same unchanging odd value, so it never detects concurrent mutation. This exposes actively mutating fields (e.g. args->ops / args->opcnt during compound decode and release) to the lockless reader, which can read past the end of the 8-element inline ops array. Add a helper that advances the counter to the next even value and call it on every return path that follows the odd-valued store. The decode-error path is left untouched as it is reached before the counter is set odd.