CVE-2026-89705 Overview
CVE-2026-89705 is a race condition in the Linux kernel's NFS server (nfsd) subsystem. The flaw exists in nfsd_dispatch(), which uses rq_status_counter as a seq-lock-like protocol to coordinate with the lockless reader in nfsd_nl_rpc_status_get_dumpit(). Only the fully successful dispatch path restored the counter to an even value. Cache-hit (RC_REPLY), drop (RC_DROPIT / RQ_DROPME), and encode-error paths returned while leaving the counter odd. This exposes actively mutating request fields, including args->ops and args->opcnt, to a concurrent reader that may then read past the end of the 8-element inline ops array.
Critical Impact
A local unprivileged user querying NFSD RPC status via netlink can trigger an out-of-bounds read of kernel memory and destabilize the NFS server.
Affected Products
- Linux kernel NFS server (nfsd) subsystem
- Kernel versions containing the nfsd_nl_rpc_status_get_dumpit() netlink dump interface prior to the fix commits
- Distributions shipping affected kernel versions with NFS server functionality enabled
Discovery Timeline
- 2026-09-11 - CVE-2026-89705 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89705
Vulnerability Analysis
The nfsd_dispatch() function coordinates with lockless readers by toggling rq_status_counter between even and odd values. Setting the counter to odd signals that a request is mid-processing. Setting it back to even signals that fields such as args->ops and args->opcnt are stable.
The defect is that only the fully successful encode path returned the counter to an even value. Cache-hit replies, dropped requests, and encode-error branches all exited while the counter remained odd. Subsequent decode operations OR in the value 1, keeping the counter odd across requests until a successful encode occurred.
While stuck odd, nfsd_nl_rpc_status_get_dumpit() treats the rqstp fields as consistent. Its retry check compares against the same unchanging odd value and never observes mutation. The reader then walks the compound operation array while the dispatcher concurrently mutates it, and can read beyond the 8-element inline ops buffer.
Root Cause
The root cause is an incomplete seq-lock protocol implementation [CWE-362 race condition]. Multiple exit paths from nfsd_dispatch() failed to advance the counter after marking the critical section as active, breaking the reader's assumption that odd-to-odd transitions indicate a single in-progress request.
Attack Vector
A local user with permission to invoke the NFSD netlink RPC status dump interface can repeatedly query status while the server processes NFS traffic. Cache-hit or dropped requests leave the counter odd, and subsequent compound decodes mutate args->ops while the reader is walking it. This yields out-of-bounds reads and potential availability loss of the NFS server.
No verified public exploit code exists for this issue. See the Kernel Git Commit b08c30f08d57 and Kernel Git Commit f6045886fe3f for the corrective patches.
Detection Methods for CVE-2026-89705
Indicators of Compromise
- Unexplained NFS server crashes, hangs, or oops messages referencing nfsd_dispatch or nfsd_nl_rpc_status_get_dumpit in kernel logs.
- KASAN reports flagging out-of-bounds reads in the NFSD compound argument structures.
- Unusual volume of netlink dump requests against the NFSD RPC status family from non-administrative local users.
Detection Strategies
- Enable KASAN on test kernels to catch out-of-bounds reads within nfsd code paths during fuzzing or QA.
- Correlate dmesg output for stack traces containing nfsd_nl_rpc_status_get_dumpit with concurrent NFS workload spikes.
- Audit installed kernel package versions against distribution advisories that reference the fix commits b08c30f08d57 and f6045886fe3f.
Monitoring Recommendations
- Monitor auditd for netlink socket activity targeting the NFSD generic netlink family from unexpected UIDs.
- Track NFS server availability metrics and alert on unexpected daemon restarts on hosts exporting NFS shares.
- Ingest kernel log telemetry into a centralized platform and alert on stack traces referencing NFSD dispatch functions.
How to Mitigate CVE-2026-89705
Immediate Actions Required
- Apply the vendor kernel update that incorporates commits b08c30f08d57 and f6045886fe3f as soon as it is available for your distribution.
- Restrict local shell access on NFS server hosts to trusted administrators only.
- Inventory systems running the nfsd kernel module and prioritize patching those exporting production shares.
Patch Information
The fix adds a helper that advances rq_status_counter to the next even value and invokes it on every return path following the odd-valued store. The decode-error path is intentionally excluded because it executes before the counter is set odd. Patches are available at Kernel Git Commit b08c30f08d57 and Kernel Git Commit f6045886fe3f.
Workarounds
- Disable the NFS server (systemctl disable --now nfs-server) on hosts that do not require it until the kernel is patched.
- Restrict access to the NFSD generic netlink family through SELinux or AppArmor policies to block unprivileged status queries.
- Limit which local users can execute netlink-based diagnostic tooling against the NFSD RPC status interface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.