CVE-2026-89679: Linux Kernel NFSD RCE Vulnerability

CVE-2026-89679 Overview

CVE-2026-89679 is a null pointer dereference vulnerability in the Linux kernel's NFS server (nfsd) implementation. The flaw resides in the nfsd4_setattr() function when processing SETATTR requests containing delegation timestamp attributes. When a client sends the NFSv4 special "one stateid" (all-0xFF bytes) alongside FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, the server dereferences an uninitialized pointer and crashes.

Any unauthenticated NFSv4 client on the network can trigger the oops. No delegation, prior state, or authentication is required.

Critical Impact
Remote unauthenticated attackers can crash the Linux kernel on NFSv4 servers by sending a single crafted COMPOUND request, causing a full denial of service.

Affected Products

Linux kernel builds with nfsd delegation timestamp attribute support
Distributions shipping vulnerable kernel commits prior to the fix
Any NFSv4 server exposing SETATTR to untrusted clients

Discovery Timeline

2026-09-11 - CVE-2026-89679 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89679

Vulnerability Analysis

The vulnerability lives in the NFSv4 SETATTR handling path inside the Linux kernel's nfsd module. When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY in its attribute bitmap, nfsd4_setattr() sets the local flag deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate the supplied stateid.

The NFSv4 protocol defines several special stateids, including the "one stateid" composed entirely of 0xFF bytes. When the client supplies this value, check_special_stateids() returns nfs_ok without populating the output nfs4_stid pointer. The s==NULL path jumps directly to the done: label and skips the if (s) block that would normally assign *cstid. Control returns to nfsd4_setattr() with the local st variable still NULL.

The subsequent if (deleg_attrs) block then dereferences st->sc_type at offset 4 from a null base address. The kernel takes an oops, terminating the nfsd worker thread and disrupting NFS service.

Root Cause

The root cause is a missing null check on the returned nfs4_stid pointer in nfsd4_setattr(). The function assumes nfs4_preprocess_stateid_op() always populates a valid stateid on success, but the special-stateid fast path violates that assumption. The upstream fix guards the pointer dereference and returns nfserr_bad_stateid, since a special stateid is never a valid delegation stateid.

Attack Vector

Exploitation requires only network reachability to the NFSv4 server's TCP port (typically 2049). An attacker sends a single COMPOUND operation containing PUTROOTFH followed by SETATTR with the special all-0xFF stateid and the delegation timestamp bit set in bmval2. No mount, credentials, or established delegation state are needed. The result is a kernel-level denial of service each time the request is issued.

See the upstream fixes: Linux Kernel Commit 3c5119b, Linux Kernel Commit 3c896db, and Linux Kernel Commit fe456c8.

Detection Methods for CVE-2026-89679

Indicators of Compromise

Kernel oops messages referencing nfsd4_setattr in dmesg or /var/log/messages
Null pointer dereference stack traces containing nfs4_preprocess_stateid_op frames
Unexpected nfsd worker thread termination or NFS service unavailability
Inbound NFSv4 COMPOUND traffic containing SETATTR operations with stateids of all 0xFF bytes

Detection Strategies

Inspect packet captures on TCP port 2049 for SETATTR requests carrying the special "one stateid" and delegation timestamp bits
Correlate NFS service crashes with concurrent SETATTR traffic from untrusted source addresses
Alert on repeated nfsd process restarts or kernel oops entries mentioning nfsd stack frames

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and create rules for BUG: and Oops: events referencing nfsd symbols
Baseline NFSv4 client populations and flag unauthenticated clients issuing SETATTR against exported roots
Track kernel package versions across the fleet to identify hosts still running vulnerable builds

How to Mitigate CVE-2026-89679

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and reboot affected NFS servers
Restrict NFSv4 access to trusted client networks using host-based firewalls or network ACLs
Audit exported filesystems and disable NFSv4 exports that are not required

Patch Information

The fix adds a null check before dereferencing the stateid pointer in nfsd4_setattr(). Merge or backport Linux Kernel Commit 3c5119b, Linux Kernel Commit 3c896db, or Linux Kernel Commit fe456c8, then rebuild and deploy the kernel. Distribution vendors are shipping backports through their standard stable kernel channels.

Workarounds

Block or firewall inbound TCP/UDP port 2049 from untrusted networks until patches are deployed
Temporarily disable NFSv4 and require NFSv3 clients where compatible, since the vulnerable code path is NFSv4-specific
Isolate NFS servers behind a bastion or VPN so only authenticated peers can reach the SETATTR handler

bash

# Restrict NFSv4 access to a trusted subnet using iptables
iptables -A INPUT -p tcp --dport 2049 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP

# Verify running kernel version after patching
uname -r