CVE-2026-89679
largeUnauthenticated DoS in Linux Kernel nfsd via NULL Dereference in NFSv4 SETATTR
A NULL pointer dereference exists in nfsd4_setattr() in the Linux kernel's NFS server, triggered when an NFSv4 client sends a SETATTR request that includes the delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) together with the special 'one stateid' (all-0xFF bytes). Because the special-stateid path in nfs4_preprocess_stateid_op() returns without populating the stateid pointer, nfsd4_setattr() unconditionally dereferences the NULL pointer, crashing the kernel. Any remote NFSv4 client that can reach the server can trigger this with a single unauthenticated COMPOUND request, resulting in denial of service (availability impact only, per CVSS 7.5). All systems running affected kernels that export NFSv4 filesystems via nfsd are impacted, though only clients with network reachability to the NFS service can exploit it. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.
What to do: Patch to a Linux kernel version containing the NULL-check fix in nfsd4_setattr() as soon as your distribution ships it. Until then, ensure TCP/2049 is not exposed to untrusted networks, restrict NFS exports and firewall rules to explicitly trusted clients, and prefer NFSv4 with strong export controls. Monitor for kernel oops/panic messages originating in nfsd as an indicator of attempted triggering.
| Linux kernel (nfsd) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr() sets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate the stateid. If the client supplies the NFSv4 "one stateid" (all-0xFF bytes), check_special_stateids() returns nfs_ok without populating the output nfs4_stid pointer, because the special-stateid path in nfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the "if (s)" block that would set *cstid is skipped. The local variable `st` remains NULL. Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally dereferences st->sc_type (at offset 4 from NULL), causing a kernel oops. This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH, SETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})]. No authentication, delegation, or prior state is required. Fix by adding a NULL check before the dereference. A special stateid is not a delegation stateid, so the existing nfserr_bad_stateid return value is already correct; we only need to guard the pointer dereference itself.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.