CVE-2026-89687: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89687 Overview

CVE-2026-89687 is a vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd_file_do_acquire(), which can operate on a file that was never actually opened. The ->atomic_open handler is permitted to return success without opening the file by calling finish_no_open(), causing dentry_create() to return an unopened file reference. If nfsd consumes this reference without verifying the FMODE_OPENED flag, undefined behavior in the NFS server can result. The condition affects availability of the NFS service.

Critical Impact
A remote, unauthenticated attacker interacting with an NFS server can trigger a kernel-side condition that impacts service availability, as reflected by the availability-only CVSS impact profile.

Affected Products

Linux kernel — nfsd (NFS server) subsystem
Kernel builds prior to the fix commits 5859cc01fee0 and a95a1cffacd0
Distributions shipping affected upstream kernels serving NFS exports

Discovery Timeline

2026-09-11 - CVE-2026-89687 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89687

Vulnerability Analysis

The Linux VFS layer allows a filesystem's ->atomic_open handler to return success without actually opening the file. The handler signals this by invoking finish_no_open(). Under this contract, dentry_create() may return a struct file * whose FMODE_OPENED flag is not set, meaning the file has a dentry but no open file state.

The nfsd path nfsd_file_do_acquire() previously assumed the returned file was fully opened. Consuming a non-opened file reference at the NFS server layer produces incorrect state handling in a code path exposed over the network to NFS clients. The upstream fix teaches nfsd to consult FMODE_OPENED before using the returned file.

While upstream maintainers describe the race as extremely unlikely because parent locking and typical handler behavior prevent it, the defensive fix eliminates the assumption. The vulnerability is scoped to availability impact rather than confidentiality or integrity.

Root Cause

The root cause is a missing invariant check in nfsd_file_do_acquire(). The function relied on the assumption that dentry_create() always returns an opened file. The VFS contract does not guarantee this. Filesystems implementing ->atomic_open may legitimately return success without opening, and nfsd did not validate the FMODE_OPENED state before acting on the file pointer. This is a kernel-level input validation error within the NFS server code path.

Attack Vector

Exploitation requires an attacker to reach an exported NFS share over the network. No authentication or user interaction is required per the CVSS vector. The attacker triggers operations that reach the ->atomic_open code path on the server, exercising a filesystem or race condition where a non-opened file is returned. The resulting mis-use of the file reference in nfsd affects service availability. The vulnerability does not expose data or allow modification of files.

See the upstream commits 5859cc01fee0 and a95a1cffacd0 for the technical fix.

Detection Methods for CVE-2026-89687

Indicators of Compromise

Unexpected nfsd kernel warnings, oops messages, or stack traces referencing nfsd_file_do_acquire, dentry_create, or finish_no_open in dmesg and /var/log/messages.
NFS clients experiencing sudden stalls, I/O errors, or loss of connectivity to previously stable exports.
Reboots or service restarts of nfs-server.service without administrator action.

Detection Strategies

Collect and centrally analyze kernel ring buffer output from NFS servers, alerting on soft lockups or panics tied to nfsd symbols.
Monitor NFS server uptime and export availability. Correlate service resets with network traffic bursts from NFS clients.
Track kernel versions across the fleet and flag hosts running vulnerable builds that also expose ports 2049/tcp and 2049/udp.

Monitoring Recommendations

Instrument NFS server hosts with kernel telemetry forwarded to a centralized log store for retrospective analysis.
Alert on repeated NFS client reconnects or RPC timeouts that could indicate server-side instability.
Baseline normal nfsd thread counts and RPC error rates. Investigate deviations that coincide with kernel messages.

How to Mitigate CVE-2026-89687

Immediate Actions Required

Inventory Linux hosts running the NFS server role and identify kernels lacking the fix commits 5859cc01fee0 or a95a1cffacd0.
Apply vendor-supplied kernel updates from your distribution as soon as they include the upstream nfsd fix, then reboot.
Restrict NFS server exposure to trusted client networks using firewall rules, /etc/exports host restrictions, and VPN segmentation.

Patch Information

The fix is available upstream in the Linux stable tree via commits 5859cc01fee0 and a95a1cffacd0. The patch modifies nfsd_file_do_acquire() to check FMODE_OPENED on the file returned by dentry_create() and only use it when the flag is set. Consumers should apply the stable backport shipped by their Linux distribution.

Workarounds

If patching cannot proceed immediately, block or restrict access to NFS ports (2049/tcp, 2049/udp, and portmapper 111) at the network perimeter and host firewall.
Limit NFS exports to specific trusted client IP ranges in /etc/exports and reload with exportfs -ra.
Where feasible, disable nfs-server.service on hosts that do not require NFS export functionality.

bash

# Configuration example
# Check current kernel version
uname -r

# Restrict NFS to a trusted subnet in /etc/exports
# /srv/nfs 10.0.0.0/24(rw,sync,no_subtree_check)
sudo exportfs -ra

# Restrict NFS ports at the host firewall (nftables example)
sudo nft add rule inet filter input tcp dport 2049 ip saddr != 10.0.0.0/24 drop
sudo nft add rule inet filter input udp dport 2049 ip saddr != 10.0.0.0/24 drop

# Disable NFS server if not required
sudo systemctl disable --now nfs-server.service