CVE-2026-89677
largeUse-After-Free in Linux Kernel nfsd NFSv4 File Creation Path
A use-after-free exists in the Linux kernel's NFS server daemon (nfsd) in the NFSv4 file-creation path nfsd4_create_file(). The flaw triggers when dentry_create() returns a different dentry than the one passed in — for example when the exported filesystem is itself NFS and the backing server returns a filehandle matching a directory already in the dcache — after which the child dentry stored in the result file handle can be freed and later dereferenced. A remote, unauthenticated attacker who can reach the NFS service with no user interaction could potentially cause memory corruption, with the assigned CVSS 3.1 score of 9.8 indicating worst-case impact of high confidentiality, integrity, and availability (kernel crash or possible code execution). Affected systems are those running the Linux kernel with nfsd serving NFSv4 exports, most notably configurations that re-export NFS-backed mounts. Upstream characterizes the triggering scenario as unlikely, no public proof-of-concept is known, and the flaw is not listed in the CISA KEV catalog.
What to do: Apply distribution kernel updates containing this nfsd fix as soon as they are released, and reboot or restart nfsd afterward. Until patched, block NFS ports (TCP/2049 and related rpcbind/nfsd ports) at perimeter firewalls, restrict exports to trusted hosts and networks, and avoid re-exporting NFS mounts through nfsd. Audit logs for unexpected NFSv4 OPEN operations from untrusted sources.
| Linux kernel (nfsd) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server returned to OPEN a filehandle which matched a directory that was already in the dcache. Clearly this would not be expected! If this were to happen the dentry (child) that was already stored in resfhp could be freed and later dereferenced. We shouldn't call fh_compose() until we are certain that we have the final dentry, so this patch moved the fh_compose() call to two places: one for the case where the target already exists, and one after dentry_create() where it was created.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.