CVE-2026-89664: Linux Kernel Privilege Escalation Flaw

CVE-2026-89664 Overview

CVE-2026-89664 is a memory leak in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the handling of POSIX Access Control Lists (ACLs) decoded during NFSv4 OPEN compound operations. When nfsd4_decode_createhow4() allocates refcounted posix_acl objects and stores them in open->op_pacl and open->op_dpacl, these references are not released along the error short-circuit path in nfsd4_open_omfg(). Every malformed OPEN compound carrying valid POSIX ACL createhow4 attributes leaks both references. Remote unauthenticated attackers with network access to the NFS service can trigger resource exhaustion by repeatedly sending crafted OPEN requests.

Critical Impact
Remote unauthenticated attackers can exhaust kernel memory on NFS servers by sending malformed OPEN compounds with POSIX ACL attributes, leading to denial of service.

Affected Products

Linux kernel nfsd subsystem (NFSv4 server implementation)
Systems exporting NFSv4 shares with POSIX ACL support enabled
Distributions shipping affected kernel versions prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-89664 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89664

Vulnerability Analysis

The vulnerability lives in the NFSv4 compound processing path inside fs/nfsd/nfs4xdr.c and fs/nfsd/nfs4proc.c. During decoding of an OPEN operation, nfsd4_decode_createhow4() invokes nfsd4_decode_fattr4(), which calls posix_acl_alloc() to build refcounted struct posix_acl objects. These objects are attached to open->op_pacl and open->op_dpacl and must be released once the compound completes.

The release logic was previously placed inside nfsd4_open() at its out_err: label. However, when nfsd4_decode_open_claim4() returns a non-seqid-mutating error, the compound dispatcher calls nfsd4_open_omfg() and returns before op_func executes. Because nfsd4_open() never runs on this path, both ACL references leak.

Root Cause

The root cause is missing resource cleanup on an error short-circuit path, classified as a memory leak. OP_OPEN had no .op_release handler registered in the nfsd4_ops[] dispatch table, so the compound loop had no unconditional site to free the decoded ACLs. Additionally, op_release() was only invoked from nfsd4_encode_operation() and not from the v4.0 replay branch nfsd4_encode_replay(), extending the leak to replayed operations.

Attack Vector

An unauthenticated remote attacker with network reachability to the NFSv4 service can craft OPEN compounds that include valid POSIX ACL createhow4 attributes followed by a malformed open_claim4 element. Each request triggers allocation of two posix_acl objects that are never released. Sustained request volume exhausts kernel slab memory, degrading server responsiveness and eventually causing denial of service.

See the upstream fixes for the exact patch content: Kernel Git Commit 5b3a7d7 and Kernel Git Commit 8215892.

Detection Methods for CVE-2026-89664

Indicators of Compromise

Sustained growth of the posix_acl slab cache visible in /proc/slabinfo without corresponding filesystem workload
Unexplained increases in kernel memory consumption on hosts running nfsd
Elevated volume of NFSv4 OPEN operations returning non-seqid-mutating errors in nfsd statistics
dmesg entries reporting slab allocation failures or OOM events tied to kernel allocations

Detection Strategies

Monitor posix_acl slab usage over time and alert on abnormal growth trends on NFS server hosts
Baseline NFSv4 OPEN error rates and flag statistical anomalies indicating malformed compound floods
Capture and inspect NFS traffic for repeated OPEN requests carrying createhow4 attributes with malformed claim structures

Monitoring Recommendations

Collect kernel slab telemetry and nfsd operation counters into a centralized analytics platform for trend analysis
Track per-client NFSv4 request rates and error ratios to identify sources of anomalous traffic
Enable network flow logging on interfaces exposing NFS services and correlate with kernel memory pressure alerts

How to Mitigate CVE-2026-89664

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921 and 8215892993ea9f5231da4fa9eb42428a286fce8b
Update to a distribution kernel that incorporates the fix as soon as vendor packages are available
Restrict NFS service exposure to trusted network segments using host firewalls or network ACLs
Reboot affected servers after patching to ensure the corrected nfsd module is loaded

Patch Information

The fix introduces nfsd4_open_release() and wires it as .op_release for OP_OPEN in nfsd4_ops[]. Because posix_acl_release() is NULL-safe, a single release site covers both the normal completion path and the nfsd4_open_omfg() short-circuit. The redundant posix_acl_release() calls at the out_err: label of nfsd4_open() are removed to prevent double-release. The op_release() call is also moved out of nfsd4_encode_operation() and placed after the encode/replay branch in nfsd4_proc_compound(), ensuring cleanup runs for both normal and v4.0 replay paths. Patch sources: Kernel Git Commit 5b3a7d7 and Kernel Git Commit 8215892.

Workarounds

Limit NFSv4 access to authenticated clients on trusted subnets using firewall rules until patches are deployed
Disable POSIX ACL support on affected NFS exports if operationally acceptable, reducing the attack surface
Deploy rate limiting on NFS-facing network interfaces to constrain the volume of malformed OPEN compounds a single client can send

bash

# Example: restrict NFS traffic to a trusted management subnet
iptables -A INPUT -p tcp --dport 2049 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP