CVE-2026-89677: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89677 Overview

CVE-2026-89677 is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd4_create_file(), where fh_compose() is called before the final dentry is confirmed. When dentry_create() returns a different dentry than the one passed in, the original dentry stored in resfhp can be freed and later dereferenced. This condition can occur when the exported filesystem is NFS and the server responds to an OPEN with a filehandle matching a directory already in the dcache. The kernel maintainers resolved the issue by moving the fh_compose() call to two distinct paths: one for pre-existing targets and one after successful dentry_create() execution.

Critical Impact
A freed dentry may be dereferenced during NFSv4 file creation, potentially leading to kernel memory corruption over the network.

Affected Products

Linux kernel (upstream) NFS server (nfsd) subsystem
Distributions shipping affected nfsd4_create_file() code paths prior to the referenced stable commits
Systems exporting NFS from an underlying NFS-mounted filesystem

Discovery Timeline

2026-09-11 - CVE-2026-89677 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89677

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the Linux kernel NFSv4 server implementation. The nfsd4_create_file() function calls fh_compose() to build a filehandle referencing a child dentry stored in resfhp before verifying the final dentry returned by dentry_create(). Because dentry_create() can return a dentry different from the one passed in, the original dentry may be released while a reference to it remains in resfhp. Any subsequent use of that filehandle dereferences freed kernel memory. The condition is triggerable through NFSv4 OPEN operations against affected servers, particularly when the backing filesystem is itself NFS.

Root Cause

The root cause is an ordering issue between filehandle composition and dentry validation. fh_compose() executes before the code confirms which dentry ultimately represents the created object. When the returned dentry differs from the input, the previously referenced dentry is dropped while resfhp still points to it, producing a stale reference.

Attack Vector

The attack vector is network-based against systems running the affected NFS server. An attacker capable of issuing NFSv4 OPEN requests, combined with a scenario where the exported filesystem returns a filehandle matching an existing dcache entry, can trigger the freed-dentry dereference. Exploitation reliability depends on kernel allocator state and the specific export configuration.

No verified public proof-of-concept code is available. Refer to the upstream commits 033e7837 and 3e2c7936 for the corrective patch details.

Detection Methods for CVE-2026-89677

Indicators of Compromise

Unexpected nfsd kernel oops or general protection fault messages referencing dentry operations in dmesg or /var/log/kern.log.
KASAN or SLUB debug reports flagging use-after-free in nfsd4_create_file or fh_compose call paths.
Repeated NFSv4 OPEN operations from a single client against exports backed by NFS mounts.

Detection Strategies

Enable kernel memory sanitizers (KASAN, SLUB_DEBUG) on test systems mirroring production NFS configurations to catch the fault path.
Monitor kernel ring buffer output for nfsd-related stack traces containing dentry_create, fh_compose, or nfsd4_create_file.
Baseline NFSv4 traffic patterns and alert on anomalous OPEN operation rates against re-exported NFS shares.

Monitoring Recommendations

Ship kernel logs to a centralized logging platform and create alerts for nfsd panic or oops signatures.
Track kernel package versions across the NFS server fleet to identify hosts still running vulnerable builds.
Audit NFS export configurations to identify servers that re-export NFS-backed filesystems, which are the highest-risk deployment pattern.

How to Mitigate CVE-2026-89677

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 033e7837 and 3e2c7936 once packaged by your distribution.
Inventory all Linux hosts running nfsd and prioritize patching servers that re-export NFS filesystems.
Restrict NFSv4 access at the network layer to authorized client subnets using firewall rules.

Patch Information

The fix relocates the fh_compose() call so it runs only after the final dentry is known. Two code paths now invoke fh_compose(): one when the target already exists and one after dentry_create() returns successfully. Consult the Linux kernel stable tree commit 033e7837 and Linux kernel stable tree commit 3e2c7936 for the authoritative changes.

Workarounds

Avoid re-exporting NFS-mounted filesystems via nfsd until patched kernels are deployed.
Disable NFSv4 on affected servers where NFSv3 is acceptable, since the vulnerable code path is specific to NFSv4 OPEN handling.
Limit exported filesystems to local storage backends until kernel updates are applied.

bash

# Verify running kernel version and nfsd module status
uname -r
lsmod | grep nfsd

# Temporarily stop the NFS server if immediate patching is not possible
systemctl stop nfs-server
systemctl disable nfs-server

# Restrict NFSv4 to trusted subnets (example using firewalld)
firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/24
firewall-cmd --permanent --zone=public --remove-service=nfs
firewall-cmd --reload