CVE-2026-89696
nicheLinux Kernel nfsd NULL Dereference via NFSv4.2 Inter-SSC COMPOUND (DoS)
The Linux kernel's NFS server daemon (nfsd) contains a remotely triggerable NULL pointer dereference when the kernel is built with the non-default CONFIG_NFSD_V4_2_INTER_SSC option (NFSv4.2 inter-server server-side copy, RFC 7862). A remote NFS client triggers the crash by sending a crafted COMPOUND request that combines an inter-SSC COPY — which causes a saved PUTFH to skip filehandle verification and leave fh_dentry/fh_export NULL — with an extra operation such as SETATTR inserted between the source PUTFH and SAVEFH; SETATTR then dereferences the NULL fh_export pointer without re-verifying the filehandle. The impact is denial of service only (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/S:U/C:N/I:N/A:H): the fault occurs in an nfsd kthread and takes down the NFS service, and any network peer that can reach the server can trigger it without authentication. Affected systems are Linux machines acting as NFSv4.2 servers with the inter-SSC feature compiled in, prior to the upstream fix that gates the dispatch loop so only SAVEFH and filehandle-independent operations may proceed (returning NFS4ERR_STALE per RFC 7862 Section 15.2.3). No public PoC exists, the flaw is not in the CISA KEV catalog, and no exploitation is known.
What to do: Apply a kernel update containing the upstream nfsd fix (dispatch-loop gating that returns NFS4ERR_STALE for ops requiring a resolved foreign filehandle) as soon as your distribution ships it. Check your kernel configuration: hosts without CONFIG_NFSD_V4_2_INTER_SSC=y are not vulnerable, so avoid enabling it or rebuild without it if patching is delayed. Restrict network access to the NFS service (TCP/UDP 2049) to trusted clients via firewall rules, since the flaw requires no authentication.
| Linux kernel (nfsd, NFSv4.2 server) | Kernel versions with CONFIG_NFSD_V4_2_INTER_SSC support built in, prior to the upstream fix commit; no specific version numbers are provided in the data |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh_export both NULL if fh_verify() returns nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag is set, but the compound dispatch loop only uses this flag to bypass the nfserr_nofilehandle check -- it does not prevent subsequent ops from running with a NULL fh_dentry. A remote client can exploit this by crafting a COMPOUND that includes an inter-SSC COPY (which causes check_if_stalefh_allowed() to set no_verify=true on the saved PUTFH) with an additional op inserted between the source PUTFH and SAVEFH. For example, SETATTR calls fh_want_write() which dereferences fh_export->ex_path.mnt without calling fh_verify() first, causing a NULL pointer dereference in the nfsd kthread. Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow) and ops with ALLOWED_WITHOUT_FH (which don't need a resolved filehandle) may proceed. All other ops receive nfserr_stale, per RFC 7862 Section 15.2.3 which specifies that foreign filehandle validation is deferred to the consuming operation and NFS4ERR_STALE returned at that point.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.