CVE-2026-89699: Linux Kernel NFSv4 Privilege Escalation

CVE-2026-89699 Overview

CVE-2026-89699 is a Linux kernel vulnerability in the NFSv4 server (nfsd) that allows a remote client to trigger large kernel memory allocations by sending crafted NFSv4 CREATE operations for symbolic links. The function nfsd4_decode_create() accepts an unbounded cr_datalen value from the wire for NF4LNK symlink targets. A malicious client can force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND operation. The allocation persists until compound teardown, enabling resource exhaustion against the NFS server.

Critical Impact
A network-adjacent, unauthenticated attacker can exhaust server memory through repeated NFSv4 COMPOUND requests, resulting in denial of service against the kernel NFS server.

Affected Products

Linux kernel nfsd (NFSv4 server) prior to the fix commits
Linux distributions shipping vulnerable stable kernel branches referenced by the upstream fixes
Any system exposing NFSv4 services with nfsd enabled

Discovery Timeline

2026-09-11 - CVE-2026-89699 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89699

Vulnerability Analysis

The flaw resides in the NFSv4 protocol decoder path within nfsd4_decode_create(). When a client issues a CREATE operation of type NF4LNK (symbolic link), the decoder reads a length field (cr_datalen) from the RPC payload and allocates a matching kernel buffer to hold the symlink target. The decoder does not enforce an upper bound consistent with NFS4_MAXPATHLEN (PATH_MAX), so the client controls the allocation size up to the RPC transport ceiling of several megabytes.

The VFS layer later rejects oversized symlink targets with ENAMETOOLONG, but by then the kernel has already committed the allocation. Because the buffer lives until COMPOUND teardown, an attacker can chain many CREATE operations in a single COMPOUND request and repeat the request to amplify memory pressure. Sustained abuse degrades the NFS server and can lead to out-of-memory conditions on the host.

Root Cause

The root cause is missing input validation on a client-supplied length field. The decoder trusts cr_datalen and issues kmalloc without a size ceiling. Zero-length values are also accepted, producing wasteful allocations that serve no valid protocol purpose.

Attack Vector

Exploitation requires network reachability to the NFSv4 service. No authentication is needed beyond whatever the server's export policy permits for CREATE operations. An attacker crafts NFSv4 COMPOUND requests containing CREATE ops with NF4LNK type and an inflated cr_datalen, then repeats the pattern to sustain memory pressure.

The upstream fix rejects cr_datalen == 0 early with nfserr_inval and rejects values greater than NFS4_MAXPATHLEN with nfserr_nametoolong, bounding the allocation before kmalloc runs. See the fix in Linux Kernel Commit b24843e and companion stable backports.

Detection Methods for CVE-2026-89699

Indicators of Compromise

Sustained NFSv4 COMPOUND traffic from a single source containing CREATE operations with NF4LNK file type and unusually large cr_datalen values.
Kernel log entries showing ENAMETOOLONG responses from the NFS server correlated with elevated kmalloc slab usage.
Growth in kernel slab caches (kmalloc-*) on NFS servers without a corresponding legitimate workload increase.

Detection Strategies

Inspect NFSv4 packet captures for CREATE ops whose symlink target length exceeds PATH_MAX (4096) or is set to zero.
Monitor nfsd server memory footprint and alert on abrupt growth in slab allocations attributable to the RPC subsystem.
Correlate NFS client source addresses with anomalous COMPOUND op counts per request.

Monitoring Recommendations

Enable NFS server audit logging and forward events to a central analytics platform for baseline comparison.
Track host-level metrics for MemAvailable, slab usage, and OOM killer activations on NFS servers.
Alert on repeated nfserr_nametoolong responses from a single client, which indicate probing of the patched path or exploitation attempts against unpatched hosts.

How to Mitigate CVE-2026-89699

Immediate Actions Required

Apply the upstream kernel fix or the vendor-provided backport for your distribution as soon as it becomes available.
Restrict NFSv4 service exposure to trusted network segments using firewall rules or host-based ACLs.
Review /etc/exports and remove unnecessary write-capable exports that allow CREATE operations from untrusted clients.

Patch Information

The fix validates cr_datalen in nfsd4_decode_create() before any allocation. Zero-length inputs return nfserr_inval, and values greater than NFS4_MAXPATHLEN return nfserr_nametoolong. Verified stable-tree commits include 041f570, 3601130, 3ef5e7a, 45ec115, 8661d3c, 888dad4, 895a485, and b24843e.

Workarounds

Block NFSv4 (TCP/UDP port 2049) at the network perimeter and permit only known client subnets.
Disable NFSv4 and require NFSv3 where operationally acceptable until patches are deployed.
Apply per-source connection and rate limits at the firewall to reduce the amplification potential of malicious COMPOUND traffic.

bash

# Configuration example: restrict NFS access with firewalld until patches are deployed
sudo firewall-cmd --permanent --zone=drop --add-source=0.0.0.0/0
sudo firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/24
sudo firewall-cmd --permanent --zone=trusted --add-service=nfs
sudo firewall-cmd --reload