CVE-2026-89696: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89696 Overview

CVE-2026-89696 is a NULL pointer dereference vulnerability in the Linux kernel's NFS server (nfsd) implementation. The flaw resides in the NFSv4.2 inter-server-to-server copy (inter-SSC) code path when CONFIG_NFSD_V4_2_INTER_SSC is enabled. A remote client can craft a COMPOUND request that inserts an additional operation between a foreign PUTFH and SAVEFH, causing subsequent operations to dereference a NULL fh_dentry or fh_export. Successful exploitation crashes the nfsd kernel thread, resulting in denial of service on the NFS server.

Critical Impact
Unauthenticated remote attackers with network access to an NFS server can trigger a kernel NULL pointer dereference, causing the nfsd service to crash and disrupting file service availability.

Affected Products

Linux kernel builds with CONFIG_NFSD_V4_2_INTER_SSC enabled
Linux distributions shipping the affected nfsd code paths prior to the referenced stable kernel commits
NFS servers exposing NFSv4.2 with inter-server copy support to untrusted clients

Discovery Timeline

2026-09-11 - CVE-2026-89696 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89696

Vulnerability Analysis

The vulnerability affects NFSv4 COMPOUND request handling in nfsd4_putfh(). When inter-SSC copy is enabled, nfsd4_putfh() can return success even though fh_verify() produced nfserr_stale, provided putfh->no_verify is set. In this state both fh_dentry and fh_export remain NULL while the NFSD4_FH_FOREIGN flag is set on the filehandle.

The compound dispatch loop only consulted NFSD4_FH_FOREIGN to skip the nfserr_nofilehandle check. It did not restrict which subsequent operations could run against the unresolved foreign filehandle. Operations that assume a valid dentry or export therefore dereferenced NULL kernel pointers, producing an oops in the nfsd kthread [CWE-476].

Root Cause

The root cause is missing operation gating after a foreign PUTFH succeeds without verification. RFC 7862 Section 15.2.3 requires that foreign filehandle validation be deferred to the consuming operation, which must return NFS4ERR_STALE. The kernel's dispatch loop did not enforce this deferral, allowing arbitrary operations to consume an unresolved filehandle.

Attack Vector

A remote NFS client constructs a single COMPOUND containing an inter-SSC COPY, which causes check_if_stalefh_allowed() to set no_verify=true on the saved PUTFH. The attacker inserts an additional operation such as SETATTR between the source PUTFH and SAVEFH. SETATTR invokes fh_want_write(), which dereferences fh_export->ex_path.mnt without a prior fh_verify(). Because fh_export is NULL, the kernel thread crashes.

The attack requires network reachability to the NFS server and the ability to issue NFSv4.2 COMPOUND requests with inter-SSC semantics. No authentication credentials are required beyond what the server accepts for NFS mounts.

Detection Methods for CVE-2026-89696

Indicators of Compromise

Kernel oops messages referencing nfsd4_putfh, fh_want_write, or NULL pointer dereferences originating from nfsd kernel threads
Unexpected nfsd thread crashes correlated with inbound NFSv4.2 COMPOUND traffic
NFS clients receiving unusual NFS4ERR_STALE or connection resets during inter-server copy operations

Detection Strategies

Monitor dmesg and journalctl -k for kernel panic traces mentioning nfsd, putfh, or fh_verify call chains
Inspect NFSv4.2 COMPOUND traffic for sequences containing inter-SSC COPY where a non-SAVEFH operation appears between the source PUTFH and SAVEFH
Track NFS service restarts and thread exits in system telemetry to identify repeat crashes

Monitoring Recommendations

Forward kernel logs from NFS servers to a centralized logging platform and alert on nfsd-related oops signatures
Baseline expected NFSv4.2 client behavior and flag anomalous COMPOUND structures at the network layer
Track availability metrics for the nfs-server service unit and alert on abnormal restart frequency

How to Mitigate CVE-2026-89696

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix commits referenced in the kernel.org stable tree
Restrict NFSv4.2 server exposure to trusted network segments until patches are applied
Disable CONFIG_NFSD_V4_2_INTER_SSC in custom kernel builds if inter-server copy is not required

Patch Information

The fix gates the COMPOUND dispatch loop so that when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, only OP_SAVEFH and operations flagged ALLOWED_WITHOUT_FH proceed. All other operations return nfserr_stale, complying with RFC 7862 Section 15.2.3. Patched kernels are available in the following stable commits: Kernel Git Commit 00c84f4, Kernel Git Commit 2d9846f, Kernel Git Commit 311f7d9, Kernel Git Commit 35f248b, Kernel Git Commit 977e6f0, Kernel Git Commit bf4d338, Kernel Git Commit c59738a, and Kernel Git Commit ffdc844.

Workarounds

Rebuild the kernel with CONFIG_NFSD_V4_2_INTER_SSC disabled where inter-server copy is not needed
Limit NFSv4.2 access using host-based firewall rules or /etc/exports restrictions to trusted client subnets
Place NFS servers behind network segmentation that blocks untrusted NFSv4.2 COMPOUND traffic

bash

# Restrict NFS server access at the firewall to trusted subnets
sudo iptables -A INPUT -p tcp --dport 2049 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 2049 -j DROP

# Verify running kernel version after patching
uname -r

# Confirm nfsd module status
sudo systemctl status nfs-server