ZeroHour

CVE-2026-89677

large

Use-After-Free in Linux Kernel nfsd NFSv4 File Creation Path

CVSS 3.1
9.8 critical
EPSS
Published
()
Modified
AI analysis

A use-after-free exists in the Linux kernel's NFS server daemon (nfsd) in the NFSv4 file-creation path nfsd4_create_file(). The flaw triggers when dentry_create() returns a different dentry than the one passed in — for example when the exported filesystem is itself NFS and the backing server returns a filehandle matching a directory already in the dcache — after which the child dentry stored in the result file handle can be freed and later dereferenced. A remote, unauthenticated attacker who can reach the NFS service with no user interaction could potentially cause memory corruption, with the assigned CVSS 3.1 score of 9.8 indicating worst-case impact of high confidentiality, integrity, and availability (kernel crash or possible code execution). Affected systems are those running the Linux kernel with nfsd serving NFSv4 exports, most notably configurations that re-export NFS-backed mounts. Upstream characterizes the triggering scenario as unlikely, no public proof-of-concept is known, and the flaw is not listed in the CISA KEV catalog.

What to do: Apply distribution kernel updates containing this nfsd fix as soon as they are released, and reboot or restart nfsd afterward. Until patched, block NFS ports (TCP/2049 and related rpcbind/nfsd ports) at perimeter firewalls, restrict exports to trusted hosts and networks, and avoid re-exporting NFS mounts through nfsd. Audit logs for unexpected NFSv4 OPEN operations from untrusted sources.

Affected
Linux kernel (nfsd)
Estimated exposure
largetens of thousands to low hundreds of thousands of internet-reachable NFS endpoints (order 10^4–10^5) — Public internet scans (e.g., Shodan) typically show on the order of 10^5 hosts with TCP/2049 open, but only a subset run Linux nfsd with NFSv4 exposed, and the bug additionally requires unusual NFS-over-NFS re-export conditions to trigger.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server returned to OPEN a filehandle which matched a directory that was already in the dcache. Clearly this would not be expected! If this were to happen the dentry (child) that was already stored in resfhp could be freed and later dereferenced. We shouldn't call fh_compose() until we are certain that we have the final dentry, so this patch moved the fh_compose() call to two places: one for the case where the target already exists, and one after dentry_create() where it was created.

Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the news

No ingested article mentions this CVE yet.