CVE-2026-89696 - Vulnerability Details

- nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export both NULL if fh_verify() returns
nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag
is set, but the compound dispatch loop only uses this flag to bypass
the nfserr_nofilehandle check -- it does not prevent subsequent ops
from running with a NULL fh_dentry.

A remote client can exploit this by crafting a COMPOUND that includes
an inter-SSC COPY (which causes check_if_stalefh_allowed() to set
no_verify=true on the saved PUTFH) with an additional op inserted
between the source PUTFH and SAVEFH. For example, SETATTR calls
fh_want_write() which dereferences fh_export->ex_path.mnt without
calling fh_verify() first, causing a NULL pointer dereference in the
nfsd kthread.

Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set
and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow)
and ops with ALLOWED_WITHOUT_FH (which don't need a resolved
filehandle) may proceed. All other ops receive nfserr_stale, per
RFC 7862 Section 15.2.3 which specifies that foreign filehandle
validation is deferred to the consuming operation and NFS4ERR_STALE
returned at that point.

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference occurs in the Linux NFSv4 server (nfsd) when a client carefully crafts a COMPOUND request that creates a foreign filehandle with NULL references and then performs a non‑SAVEFH operation such as SETATTR. The kernel does not verify the filehandle before dereferencing it, causing the nfsd kernel thread to crash and potentially leading to a system reboot. This issue is a classic CWE‑476 NULL Pointer Dereference triggered by insufficient input validation.

Affected Systems

All Linux kernel builds that enable CONFIG_NFSD_V4_2_INTER_SSC are impacted. The advisory does not specify a particular release, so any distribution kernel that includes this configuration without the applied fix is vulnerable. The vulnerability resides in the NFSv4 server (nfsd) module of the Linux kernel.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity surface; the EPSS score is < 1%, reflecting a very low yet non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker who can construct a remote COMPOUND request that includes an inter‑SSC COPY followed by a non‑SAVEFH operation can trigger a null‑pointer dereference in the nfsd kernel thread, leading to a crash of the NFS service and a potential denial of service to users relying on NFS.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b9e8638e3d9ed8334f1f7071e081860aac37e83e`	affected	< ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32
`b9e8638e3d9ed8334f1f7071e081860aac37e83e`	affected	< 00c84f4eec715e501efc080a5670114189e42507
`b9e8638e3d9ed8334f1f7071e081860aac37e83e`	affected	< 2d9846fd1c767920fddd4bde30eb35cd2969df13
`b9e8638e3d9ed8334f1f7071e081860aac37e83e`	affected	< 977e6f006a7a3ffc4216ae6034f768f8de6fd138
`b9e8638e3d9ed8334f1f7071e081860aac37e83e`	affected	< 35f248bd40b47b229d4999581df45b97daadd977
`b9e8638e3d9ed8334f1f7071e081860aac37e83e`	affected	< 311f7d926630940650447cbd1c932b076b40a6c4
`b9e8638e3d9ed8334f1f7071e081860aac37e83e`	affected	< bf4d338dc8625d70c7f2cb0657d66851a7ac9154
`b9e8638e3d9ed8334f1f7071e081860aac37e83e`	affected	< c59738a00aa51b16adc1b5ceb7c80877168efb4d

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b9e8638e3d9ed8334f1f7071e081860aac37e83e,35f248bd40b47b229d4999581df45b97daadd977)`	affected	code_commit	—
`[b9e8638e3d9ed8334f1f7071e081860aac37e83e,311f7d926630940650447cbd1c932b076b40a6c4)`	affected	code_commit	—
`[b9e8638e3d9ed8334f1f7071e081860aac37e83e,bf4d338dc8625d70c7f2cb0657d66851a7ac9154)`	affected	code_commit	—
`[b9e8638e3d9ed8334f1f7071e081860aac37e83e,c59738a00aa51b16adc1b5ceb7c80877168efb4d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the commit which guards the dispatch loop for foreign filehandles.
If inter‑SSC filehandles are not required, disable CONFIG_NFSD_V4_2_INTER_SSC in the kernel configuration.
After applying the patch or reconfiguration, restart the NFS service to load the updated module.

Generated by OpenCVE AI on September 15, 2026 at 19:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00762.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00c84f4eec715e501efc080a5670114189e42507
https://git.kernel.org/stable/c/2d9846fd1c767920fddd4bde30eb35cd2969df13
https://git.kernel.org/stable/c/311f7d926630940650447cbd1c932b076b40a6c4
https://git.kernel.org/stable/c/35f248bd40b47b229d4999581df45b97daadd977
https://git.kernel.org/stable/c/977e6f006a7a3ffc4216ae6034f768f8de6fd138
https://git.kernel.org/stable/c/bf4d338dc8625d70c7f2cb0657d66851a7ac9154
https://git.kernel.org/stable/c/c59738a00aa51b16adc1b5ceb7c80877168efb4d
https://git.kernel.org/stable/c/ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32
https://nvd.nist.gov/vuln/detail/CVE-2026-89696
https://www.cve.org/CVERecord?id=CVE-2026-89696

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/00c84f4eec715e501efc080a5670114189e42507 https://git.kernel.org/stable/c/2d9846fd1c767920fddd4bde30eb35cd2969df13 https://git.kernel.org/stable/c/977e6f006a7a3ffc4216ae6034f768f8de6fd138 https://git.kernel.org/stable/c/ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89696 https://www.cve.org/CVERecord?id=CVE-2026-89696
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sat, 12 Sep 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh_export both NULL if fh_verify() returns nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag is set, but the compound dispatch loop only uses this flag to bypass the nfserr_nofilehandle check -- it does not prevent subsequent ops from running with a NULL fh_dentry. A remote client can exploit this by crafting a COMPOUND that includes an inter-SSC COPY (which causes check_if_stalefh_allowed() to set no_verify=true on the saved PUTFH) with an additional op inserted between the source PUTFH and SAVEFH. For example, SETATTR calls fh_want_write() which dereferences fh_export->ex_path.mnt without calling fh_verify() first, causing a NULL pointer dereference in the nfsd kthread. Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow) and ops with ALLOWED_WITHOUT_FH (which don't need a resolved filehandle) may proceed. All other ops receive nfserr_stale, per RFC 7862 Section 15.2.3 which specifies that foreign filehandle validation is deferred to the consuming operation and NFS4ERR_STALE returned at that point.
Title		nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/311f7d926630940650447cbd1c932b076b40a6c4 https://git.kernel.org/stable/c/35f248bd40b47b229d4999581df45b97daadd977 https://git.kernel.org/stable/c/bf4d338dc8625d70c7f2cb0657d66851a7ac9154 https://git.kernel.org/stable/c/c59738a00aa51b16adc1b5ceb7c80877168efb4d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:15.030Z

Updated: 2026-09-14T12:02:03.192Z

Reserved: 2026-09-11T19:38:34.750Z

Link: CVE-2026-89696

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:56.717

Modified: 2026-09-14T13:19:19.897

Link: CVE-2026-89696

Redhat

Severity : Important

Publid Date: 2026-09-11T19:46:15Z

Links: CVE-2026-89696 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:00:08Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object