Cloudanix VulnDB

CVE-2026-89687

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A rare bug in the Linux kernel's file-sharing server code could let attackers briefly disrupt access to shared files by causing the server to mishandle certain internal operations.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

nfsd_file_do_acquire() may receive and operate on a file structure returned by dentry_create() that was never opened because ->atomic_open succeeded via finish_no_open() without setting FMODE_OPENED.

Why it matters to the business

NFS servers may experience crashes or denial-of-service conditions, interrupting file-sharing services for users and applications.

How an attack unfolds

An attacker sends NFS requests that exercise dentry creation paths; under rare timing conditions atomic_open returns without opening the file, allowing nfsd to proceed with an invalid file object and trigger a crash or undefined behavior.

How to fix it

Apply the upstream kernel commit that adds an FMODE_OPENED check inside nfsd_file_do_acquire before using the file returned by dentry_create.

How to confirm the fix worked

Review the patched nfsd_file_do_acquire source for the FMODE_OPENED guard; perform stress testing of NFS mount and file operations to confirm stability.

Typical attack path

  1. Issue NFS operations that reach dentry_create via atomic_open
  2. Trigger finish_no_open path leaving FMODE_OPENED unset
  3. Force nfsd_file_do_acquire to consume the unopened file object

How to detect it

Search kernel logs and system crash reports for nfsd file-handling faults or oops messages occurring after dentry or atomic_open activity.

What your security team should do

  • Patch Linux kernels hosting NFS servers with the supplied fix
  • Prioritize systems with high NFS exposure or public reachability
  • Monitor kernel logs for nfsd-related oops or panics until patched

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permitted to return success without actually opening the file. It indicates this by calling finish_no_open(). This means dentry_create() can return a file which hasn't been opened. This is extremely unlikely as ->atomic_open handlers typically use finish_no_open() only for already existing files, and dentry_create() isn't called in that case, and the parent being locked should prevent races. However out of an abundance of caution it seems wise to teach nfsd to only use the file returned by dentry_create() if FMODE_OPENED is set, indicating that it has in fact been opened.

Affected packages

Ecosystem Package Introduced Fixed