CVE-2026-89699

A denial-of-service vulnerability exists in the Linux kernel's NFS server daemon (nfsd): when decoding an NFSv4 CREATE request for a symlink (NF4LNK), nfsd4_decode_create() trusts the client-supplied cr_datalen field from the wire without any bounds check, causing a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND operation. The allocation persists until compound teardown, and although the VFS eventually rejects oversized targets with ENAMETOOLONG, that rejection happens only after the memory has already been allocated. An attacker needs only the ability to send NFSv4 COMPOUND requests to the server (network vector, no privileges per CVSS 3.1 score 7.5) and can repeat these requests to exhaust kernel memory, degrading or crashing the NFS service with no confidentiality or integrity impact. Any Linux system running the in-kernel nfsd with NFSv4 reachable by clients is affected; fixed kernels reject cr_datalen == 0 with nfserr_inval and cr_datalen greater than NFS4_MAXPATHLEN with nfserr_nametoolong before allocating. No public proof of concept is known, the flaw is not in CISA's KEV, and no exploitation in the wild has been reported.

What to do: Upgrade to a kernel build containing the fix (early rejection of cr_datalen == 0 and cr_datalen > NFS4_MAXPATHLEN); the CVE record does not specify a fixed version number, so track your distro's kernel advisories for the nfsd NFSv4 symlink-length patch. In the meantime, restrict NFSv4 exports to explicitly trusted client hosts and networks, and filter ports 2049/tcp and 2049/udp at perimeter firewalls — internet-exposed NFS should be eliminated entirely. Monitor knfsd memory usage and OOM events for signs of abuse, noting that impact is availability-only, so patch priority can be weighed accordingly.