CVE-2026-89701: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89701 Overview

CVE-2026-89701 is an input validation vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode paths, which accept a raw uint32_t nanoseconds field and store it directly into tv_nsec without validating that the value is less than NSEC_PER_SEC. A malformed NFSv4 timespec can propagate through notify_change() and be written to disk, producing invalid timestamps on the underlying filesystem.

Critical Impact
A malicious or malformed NFSv4 client request can inject out-of-range nanosecond values into filesystem inode timestamps via the NFSD SETATTR and CB_GETATTR paths.

Affected Products

Linux kernel nfsd (NFS server) subsystem
Kernel versions containing the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms
Systems exporting NFSv4 shares with delegation-capable attribute handling

Discovery Timeline

2026-09-11 - CVE-2026-89701 published to the National Vulnerability Database
2026-09-11 - Last updated in the NVD database

Technical Details for CVE-2026-89701

Vulnerability Analysis

The vulnerability is an improper input validation issue in the Linux kernel NFS server. NFSv4 encodes timestamps as a 64-bit seconds value and a 32-bit nanoseconds value. A valid nanoseconds component must satisfy nseconds < NSEC_PER_SEC (1,000,000,000). The legacy decoder nfsd4_decode_nfstime4 enforces this constraint, but the xdrgen-generated decode arms for TIME_DELEG_ACCESS and TIME_DELEG_MODIFY copy the wire value directly into struct timespec64.tv_nsec without any range check.

An attacker controlling an NFSv4 client can submit SETATTR operations carrying nanosecond values up to 0xFFFFFFFF. The malformed timespec reaches notify_change() and is applied to the underlying inode, resulting in filesystem metadata with out-of-range timestamp fields. The same defect exists in the callback path (CB_GETATTR) handled by nfs4callback.c.

Root Cause

The root cause is missing bounds validation in the decode arms generated by xdrgen for the TIME_DELEG_* attribute variants. The parser trusts the raw wire value and skips the < NSEC_PER_SEC check that the hand-written path enforces. This is a classic case of divergent validation between two code paths that decode the same on-wire structure.

Attack Vector

The attack requires the ability to send NFSv4 SETATTR requests to a vulnerable NFS server, or to influence data returned in an NFSv4 CB_GETATTR callback. Any client authorized to write to an exported filesystem can trigger the flaw by constructing a fattr4 payload with a TIME_ACCESS or TIME_MODIFY element encoded using the TIME_DELEG variant and a nseconds field greater than or equal to 1,000,000,000. The server accepts the value and forwards the malformed timespec to the VFS layer.

Because no verified public exploit code exists, this section describes the mechanism in prose only. Details of the fix are available in the upstream commits 0f4a767340fa, 5eb489831a9f, and 7e7b93da7fa2.

Detection Methods for CVE-2026-89701

Indicators of Compromise

Inode timestamps on NFS-exported filesystems with st_atim.tv_nsec or st_mtim.tv_nsec values equal to or greater than 1,000,000,000.
Unexpected NFS4ERR_INVAL responses correlated with NFSv4 SETATTR traffic from a specific client after applying the fix.
NFSv4 SETATTR PDUs on the wire containing fattr4_time_access or fattr4_time_modify values whose nanoseconds field decodes to an out-of-range value.

Detection Strategies

Audit exported filesystems using stat or debugfs to enumerate files with invalid nanosecond components in access or modification timestamps.
Inspect NFSv4 traffic with tshark or wireshark filters targeting nfs.fattr4.time_access and nfs.fattr4.time_modify for values outside the valid range.
Correlate kernel version inventories with the fixed stable commits to identify hosts still running vulnerable nfsd code.

Monitoring Recommendations

Enable NFS server audit logging and forward events to a centralized log platform for anomaly analysis.
Track NFSv4 client identities that issue SETATTR operations at high rates or with unusual attribute masks.
Alert on filesystem integrity scan findings that surface impossible timestamp values on production shares.

How to Mitigate CVE-2026-89701

Immediate Actions Required

Update the Linux kernel to a stable release that includes commits 0f4a767340fa, 5eb489831a9f, and 7e7b93da7fa2.
Restrict NFSv4 export access to trusted client networks and enforce sec=krb5 or stronger authentication where feasible.
Audit existing NFS-exported filesystems for files carrying out-of-range timestamp values and repair affected metadata.

Patch Information

The fix adds explicit nseconds < NSEC_PER_SEC range checks in both the SETATTR decode path in nfs4xdr.c and the CB_GETATTR decode path in nfs4callback.c. The upstream commits are 0f4a767340fa, 5eb489831a9f, and 7e7b93da7fa2. Rebuild and reboot into the patched kernel; module reload alone is not sufficient because nfsd is typically built in or loaded early.

Workarounds

Disable NFSv4 exports or downgrade to NFSv3 on servers that cannot be patched immediately.
Limit NFSv4 client access using firewall rules or /etc/exports host restrictions to reduce untrusted request exposure.
Deploy Kerberos-authenticated mounts to prevent anonymous clients from issuing malformed SETATTR operations.

bash

# Verify the running kernel and confirm nfsd version alignment with the fix
uname -r
modinfo nfsd | grep -E 'filename|version'

# Restrict NFSv4 exports to trusted subnets in /etc/exports
# /srv/nfs  10.0.0.0/24(rw,sec=krb5,sync,no_subtree_check)
exportfs -rav