CVE-2026-89683: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89683 Overview

CVE-2026-89683 is a resource leak vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd_set_fh_dentry(), which fails to release a dentry reference obtained from exportfs_decode_fh_raw() when the NFS3_FHSIZE or NFS_FHSIZE switch cases detect NFSEXP_V4ROOT and jump to the out: label. The out: label calls exp_put() but never dput(dentry), and because fhp->fh_dentry was never assigned, fh_put() cannot compensate for the missed release. A crafted NFSv3 filehandle targeting a V4ROOT export's fsid triggers the leak on every request, gradually exhausting kernel resources.

Critical Impact
Remote clients can force a dentry reference leak on each malformed NFSv3 request against a V4ROOT export, leading to kernel resource exhaustion and potential denial of service on NFS servers.

Affected Products

Linux kernel — nfsd (NFS server) subsystem
Systems exporting NFS with NFSEXP_V4ROOT flagged exports
Stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89683 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89683

Vulnerability Analysis

The Linux kernel's NFS server implements filehandle-to-dentry resolution through nfsd_set_fh_dentry(). This function calls exportfs_decode_fh_raw() to translate a wire-format filehandle into a kernel dentry pointer. When the filehandle size matches NFS3_FHSIZE or NFS_FHSIZE and the resolved export carries the NFSEXP_V4ROOT flag, the function branches to the out: cleanup label without assigning the returned dentry to fhp->fh_dentry.

The out: label only invokes exp_put() to release the export reference. It does not call dput() on the intermediate dentry. Because fhp->fh_dentry was never populated, the downstream fh_put() invocation cannot reach the leaked reference either. Each request against a V4ROOT export using an NFSv3-sized filehandle therefore increments a dentry's reference count that is never decremented.

Root Cause

The root cause is missing cleanup in an error path [CWE-772: Missing Release of Resource after Effective Lifetime]. The V4ROOT rejection logic short-circuits before the code that would normally transfer dentry ownership to the filehandle structure. This leaves an orphaned reference that persists for the lifetime of the kernel or until the associated filesystem is forcibly unmounted.

Attack Vector

An attacker with network access to an NFS server exporting a V4ROOT-flagged filesystem can craft NFSv3 requests that carry a filehandle sized to NFS3_FHSIZE or NFS_FHSIZE and target the V4ROOT export's fsid. Each such request forces one dentry reference to leak. Sustained request volume incrementally pins dentries, inodes, and their backing filesystem state, eventually preventing unmount operations and consuming slab memory. See the upstream nfsd fix commit for the corrected control flow.

Detection Methods for CVE-2026-89683

Indicators of Compromise

Unexpectedly high dentry slab usage reported by /proc/slabinfo or slabtop on NFS servers with V4ROOT exports.
Filesystems backing V4ROOT exports that refuse to unmount cleanly despite no active user-space references.
Elevated volume of NFSv3 traffic against servers configured primarily for NFSv4 pseudo-root exports.

Detection Strategies

Monitor kernel slab caches (dentry, nfsd_file) for sustained growth uncorrelated with legitimate workload changes.
Inspect NFS server logs and packet captures for NFSv3 LOOKUP, GETATTR, or ACCESS calls carrying filehandles that resolve to V4ROOT exports.
Compare running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts.

Monitoring Recommendations

Alert on abnormal growth of dentry and inode slab objects on NFS export hosts.
Track NFSv3 protocol usage on servers intended to serve only NFSv4 clients and flag anomalous sources.
Correlate memory pressure events on NFS servers with inbound RPC request rates to surface leak-driven exhaustion.

How to Mitigate CVE-2026-89683

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all NFS servers exporting V4ROOT filesystems.
Restrict NFS server network exposure to trusted client subnets using firewall rules until patches are deployed.
Audit exports for the refer or v4root options and inventory hosts that require priority patching.

Patch Information

The fix ensures dput(dentry) is called on the V4ROOT rejection path before jumping to the cleanup label, releasing the reference obtained from exportfs_decode_fh_raw(). Patched kernels are available through the stable tree commits 11db8df1, 6247023f, c1ae0f97, and d493cf57. Rebuild or install the vendor kernel package containing these commits and reboot affected hosts.

Workarounds

Disable NFSv3 on servers that only require NFSv4 by removing vers=3 support in /etc/nfs.conf or the equivalent systemd unit configuration.
Remove or reconfigure v4root-flagged exports until patched kernels are deployed, if operational requirements permit.
Enforce client allow-lists in /etc/exports and upstream firewalls to limit exposure to attacker-controlled filehandles.

bash

# Disable NFSv3 on the server (example for /etc/nfs.conf)
[nfsd]
vers3=n
vers4=y
vers4.1=y
vers4.2=y

# Reload the NFS server to apply
systemctl restart nfs-server