Cloudanix VulnDB

CVE-2026-89664

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's NFS server code can cause memory to be used up over time when handling certain bad requests, which might slow down or crash file-sharing services.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak of refcounted POSIX ACL objects allocated during nfsd4_decode_fattr4 for OPEN compounds; objects are not released on short-circuit error paths before op_func or on replay encoding paths because OP_OPEN lacked an .op_release handler.

Why it matters to the business

NFS servers may experience gradual memory exhaustion when processing malformed or replayed NFSv4 OPEN requests carrying POSIX ACL createhow4 attributes, potentially leading to degraded performance or denial of service under sustained load.

How an attack unfolds

An attacker sends NFSv4 compound requests containing OPEN operations with valid POSIX ACL attributes that trigger non-seqid-mutating decode errors or v4.0 replays; the missing release logic on those paths causes the kernel to retain the allocated ACL references indefinitely.

How to fix it

Apply the upstream kernel commit that adds nfsd4_open_release as the .op_release handler for OP_OPEN, moves the single op_release call after the normal/replay if-else in nfsd4_proc_compound, and removes the duplicate releases from nfsd4_open out_err.

How to confirm the fix worked

Confirm the presence of nfsd4_open_release wired in nfsd4_ops[] for OP_OPEN and verify that op_release is invoked unconditionally after both nfsd4_encode_operation and nfsd4_encode_replay paths in nfsd4_proc_compound.

Typical attack path

  1. Craft NFSv4 compound with OP_OPEN carrying createhow4 POSIX ACL fattrs
  2. Induce nfsd4_decode_open_claim4 to return a non-seqid-mutating error
  3. Trigger short-circuit in nfsd4_proc_compound before nfsd4_open runs
  4. Alternatively force v4.0 replay path via nfsd4_encode_replay
  5. Repeat to accumulate leaked ACL references until memory pressure occurs

How to detect it

Review kernel memory statistics and slab allocator usage for posix_acl growth; inspect nfsd compound processing logs or packet captures for repeated OPEN compounds with createhow4 ACLs that return early errors or trigger replays.

What your security team should do

  • Prioritize patching NFS servers running vulnerable kernels, especially those exposing NFSv4 to untrusted networks
  • Monitor memory usage on nfsd processes and set up alerts for sustained growth correlated with OPEN traffic
  • Consider temporary mitigation via firewall rules or nfsd configuration to drop compounds containing createhow4 ACL attributes if patching is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via op_release nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates refcounted struct posix_acl objects via posix_acl_alloc() and stores them in open->op_pacl and open->op_dpacl. These pointers must be released once the OPEN compound finishes. When nfsd4_decode_open_claim4() returns a non-seqid-mutating error, the dispatcher short-circuits before op_func runs: nfsd4_proc_compound() if (op->status && op->opnum == OP_OPEN) op->status = nfsd4_open_omfg(...) if (!seqid_mutating_err(ntohl(op->status))) return op->status; /* nfsd4_open() never runs */ ... opdesc->op_release(&op->u) /* must still release op_pacl/op_dpacl */ Before this change OP_OPEN had no .op_release in nfsd4_ops[], and the release pair lived inside nfsd4_open() at its out_err: label. On the short-circuit path nfsd4_open() is never invoked, so both posix_acl refs leak on every malformed OPEN compound that carries valid POSIX ACL createhow4 attributes. Add nfsd4_open_release() and wire it as .op_release for OP_OPEN. posix_acl_release() is NULL-safe, so the single release site covers both the normal path and the nfsd4_open_omfg short-circuit. Remove the matching posix_acl_release() pair from nfsd4_open()'s out_err: label to avoid double-releasing. The compound loop has two encoding branches: nfsd4_encode_operation() for normal ops, and nfsd4_encode_replay() for v4.0 replayed ops. op_release was only called from nfsd4_encode_operation(), so resources attached to op->u leak on the replay path. Move the op_release() call out of nfsd4_encode_operation() and the replay branch, placing it after the if-else in nfsd4_proc_compound(). This gives a single call site in a fairly obviously-correct place, covering both the normal encoding and replay paths.

Affected packages

Ecosystem Package Introduced Fixed