Cloudanix VulnDB

CVE-2026-89677

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux file-sharing server could let remote attackers crash the service or take over the machine if they can reach the server over the network.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in nfsd4_create_file() when dentry_create() returns a different dentry than expected, allowing a previously stored dentry in resfhp to be freed and subsequently dereferenced during fh_compose operations.

Why it matters to the business

Remote attackers could crash NFS servers or achieve code execution, interrupting file-sharing services and potentially compromising systems that expose NFS exports to untrusted networks.

How an attack unfolds

An attacker sends specially crafted NFSv4 CREATE or OPEN requests against an exported filesystem; the server hits the dentry mismatch path, performs the premature free, and dereferences the dangling pointer during subsequent compose operations.

How to fix it

Apply the upstream kernel patch that relocates the fh_compose() calls to occur only after the final dentry is confirmed; rebuild and deploy the fixed kernel on all NFS servers.

How to confirm the fix worked

Verify the running kernel contains the commit that moves fh_compose() after dentry_create() success; confirm via kernel source inspection or distribution advisory that the nfsd4_create_file() change is present.

Typical attack path

  1. Identify an NFS server exporting a filesystem reachable over the network
  2. Send NFSv4 CREATE/OPEN compound requests that trigger dentry_create() to return an unexpected dentry
  3. Trigger the fh_compose call that operates on the now-freed child dentry stored in resfhp
  4. Achieve use-after-free dereference leading to crash or memory corruption

How to detect it

Search kernel logs for NFSd oops or use-after-free warnings referencing nfsd4_create_file or fh_compose; correlate with inbound NFSv4 CREATE traffic from untrusted sources.

What your security team should do

  • Prioritize patching all exposed NFS servers within the next maintenance window
  • Restrict NFS exposure to trusted networks until patches are applied
  • Monitor for unexpected NFS server restarts or oops messages in system logs

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server returned to OPEN a filehandle which matched a directory that was already in the dcache. Clearly this would not be expected! If this were to happen the dentry (child) that was already stored in resfhp could be freed and later dereferenced. We shouldn't call fh_compose() until we are certain that we have the final dentry, so this patch moved the fh_compose() call to two places: one for the case where the target already exists, and one after dentry_create() where it was created.

Affected packages

Ecosystem Package Introduced Fixed