CVE-2026-89696nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh_export both NULL if fh_verify() returns nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag is set, but the compound dispatch loop only uses this flag to bypass the nfserr_nofilehandle check -- it does not prevent subsequent ops from running with a NULL fh_dentry. A remote client can exploit this by crafting a COMPOUND that includes an inter-SSC COPY (which causes check_if_stalefh_allowed() to set no_verify=true on the saved PUTFH) with an additional op inserted between the source PUTFH and SAVEFH. For example, SETATTR calls fh_want_write() which dereferences fh_export->ex_path.mnt without calling fh_verify() first, causing a NULL pointer dereference in the nfsd kthread. Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow) and ops with ALLOWED_WITHOUT_FH (which don't need a resolved filehandle) may proceed. All other ops receive nfserr_stale, per RFC 7862 Section 15.2.3 which specifies that foreign filehandle validation is deferred to the consuming operation and NFS4ERR_STALE returned at that point.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b9e8638e3d9ed8334f1f7071e081860aac37e83e before ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32; from b9e8638e3d9ed8334f1f7071e081860aac37e83e before 00c84f4eec715e501efc080a5670114189e42507; from b9e8638e3d9ed8334f1f7071e081860aac37e83e before 2d9846fd1c767920fddd4bde30eb35cd2969df13; from b9e8638e3d9ed8334f1f7071e081860aac37e83e before 977e6f006a7a3ffc4216ae6034f768f8de6fd138; from b9e8638e3d9ed8334f1f7071e081860aac37e83e before 35f248bd40b47b229d4999581df45b97daadd977; from b9e8638e3d9ed8334f1f7071e081860aac37e83e before 311f7d926630940650447cbd1c932b076b40a6c4; from b9e8638e3d9ed8334f1f7071e081860aac37e83e before bf4d338dc8625d70c7f2cb0657d66851a7ac9154; from b9e8638e3d9ed8334f1f7071e081860aac37e83e before c59738a00aa51b16adc1b5ceb7c80877168efb4d | CNA record |
References
- https://git.kernel.org/stable/c/ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32
- https://git.kernel.org/stable/c/00c84f4eec715e501efc080a5670114189e42507
- https://git.kernel.org/stable/c/2d9846fd1c767920fddd4bde30eb35cd2969df13
- https://git.kernel.org/stable/c/977e6f006a7a3ffc4216ae6034f768f8de6fd138
- https://git.kernel.org/stable/c/35f248bd40b47b229d4999581df45b97daadd977
- https://git.kernel.org/stable/c/311f7d926630940650447cbd1c932b076b40a6c4
- https://git.kernel.org/stable/c/bf4d338dc8625d70c7f2cb0657d66851a7ac9154
- https://git.kernel.org/stable/c/c59738a00aa51b16adc1b5ceb7c80877168efb4d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.