Cloudanix VulnDB

CVE-2026-89679

High · 7.5

CVSS

7.5

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel lets anyone on the network crash file servers that use NFS, stopping access to shared files until the server is restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in nfsd4_setattr() triggered when an NFSv4 SETATTR request specifies FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY attributes together with the all-0xFF one-stateid; check_special_stateids() returns without populating the nfs4_stid pointer, leaving the local st variable NULL and causing an unconditional dereference of st->sc_type.

Why it matters to the business

Remote unauthenticated attackers can crash Linux NFSv4 servers, producing immediate denial of service for all clients that rely on those exports and requiring manual or automated reboot to restore availability.

How an attack unfolds

An attacker sends a single unauthenticated NFSv4 COMPOUND containing PUTROOTFH followed by SETATTR that carries the one-stateid and the delegation-timestamp attribute bitmap; the server path through nfs4_preprocess_stateid_op() and the subsequent deleg_attrs block dereferences a NULL pointer, oopsing the kernel.

How to fix it

Apply the upstream fix that inserts a NULL check on the stateid pointer before the deleg_attrs dereference in nfsd4_setattr; update to a kernel containing the corrected nfsd code.

How to confirm the fix worked

Confirm the presence of the added NULL guard in the nfsd4_setattr source; recompile or install the patched kernel and verify that the crafted SETATTR request now returns nfserr_bad_stateid instead of causing an oops.

Typical attack path

  1. Craft an NFSv4 COMPOUND request beginning with PUTROOTFH
  2. Append a SETATTR operation that uses the all-0xFF one-stateid and sets FATTR4_WORD2_TIME_DELEG_ACCESS in the attribute bitmap
  3. Transmit the request to any reachable NFSv4 listener
  4. Trigger the NULL dereference and resulting kernel oops

How to detect it

Search kernel logs and systemd journals for oops or panic entries that reference nfsd4_setattr, null pointer dereference at offset 4, or the delegation timestamp attribute handling path.

  • nfsd4_setattr
  • FATTR4_WORD2_TIME_DELEG_ACCESS
  • one stateid
  • sc_type
  • nfs4_preprocess_stateid_op

What your security team should do

  • Patch all Linux systems exposing NFSv4 as soon as a fixed kernel is available
  • Temporarily restrict NFSv4 access to trusted networks until patches are deployed
  • Enable kernel panic logging and central collection of oops reports for rapid detection of attempted exploitation

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr() sets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate the stateid. If the client supplies the NFSv4 "one stateid" (all-0xFF bytes), check_special_stateids() returns nfs_ok without populating the output nfs4_stid pointer, because the special-stateid path in nfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the "if (s)" block that would set *cstid is skipped. The local variable `st` remains NULL. Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally dereferences st->sc_type (at offset 4 from NULL), causing a kernel oops. This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH, SETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})]. No authentication, delegation, or prior state is required. Fix by adding a NULL check before the dereference. A special stateid is not a delegation stateid, so the existing nfserr_bad_stateid return value is already correct; we only need to guard the pointer dereference itself.

Affected packages

Ecosystem Package Introduced Fixed