CVE-2026-89687

The Linux kernel's NFS server code (nfsd) could, in nfsd_file_do_acquire(), use a file returned by dentry_create() that was never actually opened, because an ->atomic_open handler is permitted to report success via finish_no_open() without opening the file. An attacker with network access to an NFS export could in theory trigger this only through a rare race during file creation, causing nfsd to operate on an unopened file and most likely crash or disrupt the service; the CVSS 7.5 vector confirms an availability-only impact (no confidentiality or integrity effect) requiring no privileges or user interaction. Affected systems are Linux hosts running kernels whose nfsd uses the dentry_create() file-creation path, though the kernel developers note the condition is extremely unlikely in practice because atomic_open handlers use finish_no_open() only for already-existing files and parent-directory locking should prevent the race. The fix teaches nfsd to only use the returned file when the FMODE_OPENED flag is set. There is no public proof of concept, the CVE is not in CISA's KEV catalog, and no exploitation is known.

What to do: Apply kernel updates from your distribution once they include the fix (nfsd now checks the FMODE_OPENED flag before using a file returned by dentry_create()); as an availability-only, hard-to-trigger flaw this can be handled in normal patch cycles rather than as an emergency. Ensure NFS (TCP/UDP 2049) is not reachable from untrusted networks and that exports are restricted to trusted hosts and subnets. If you run nfsd on very recent mainline-based kernels, verify you have the patched build and monitor nfsd for crashes.