Cloudanix VulnDB

CVE-2026-89696

High · 7.5

CVSS

7.5

EPSS

0.8%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux file-sharing service can let a remote attacker crash the server by sending a specially crafted sequence of requests.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in nfsd compound dispatch when NFSD4_FH_FOREIGN is set with fh_dentry and fh_export both NULL; subsequent operations such as SETATTR call fh_want_write() which dereferences fh_export->ex_path.mnt without prior verification.

Why it matters to the business

Remote unauthenticated denial of service against Linux NFS servers running with CONFIG_NFSD_V4_2_INTER_SSC, causing unplanned outages for file-sharing workloads 43 days after disclosure with low observed exploitation probability.

How an attack unfolds

An attacker sends an NFSv4 COMPOUND containing an inter-SSC COPY (which sets no_verify=true on the saved PUTFH) followed by a non-SAVEFH operation such as SETATTR between the source PUTFH and SAVEFH; the dispatch loop permits the operation to run with a NULL fh_export, triggering the kernel NULL dereference.

How to fix it

Apply the upstream kernel patch that gates the dispatch loop to allow only OP_SAVEFH and ALLOWED_WITHOUT_FH operations when NFSD4_FH_FOREIGN is set and fh_dentry is NULL; rebuild and reboot to the fixed kernel.

How to confirm the fix worked

Confirm kernel source contains the added dispatch check for NFSD4_FH_FOREIGN && fh_dentry==NULL; recompile with CONFIG_NFSD_V4_2_INTER_SSC and verify that crafted inter-SSC COMPOUNDs now return NFS4ERR_STALE instead of crashing.

Typical attack path

  1. Establish NFSv4.2 session to target server with inter-SSC support enabled
  2. Issue COMPOUND starting with PUTFH that triggers stale FH and sets NFSD4_FH_FOREIGN + no_verify
  3. Insert SETATTR, WRITE, or similar operation before the required SAVEFH
  4. nfsd kthread dereferences NULL fh_export causing kernel oops and process termination

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for nfsd oops or NULL pointer dereference messages containing fh_export or fh_dentry references; correlate with unusual NFSv4 COMPOUND traffic on port 2049.

  • nfsd:.*NULL pointer dereference
  • fh_export->ex_path.mnt
  • check_if_stalefh_allowed
  • NFSD4_FH_FOREIGN

What your security team should do

  • Prioritize kernel update on all systems exposing NFSv4.2 with inter-server copy enabled
  • Temporarily disable CONFIG_NFSD_V4_2_INTER_SSC if immediate patching is not feasible
  • Monitor nfsd oops and kernel panic logs for the next 30 days given stable low EPSS

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh_export both NULL if fh_verify() returns nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag is set, but the compound dispatch loop only uses this flag to bypass the nfserr_nofilehandle check -- it does not prevent subsequent ops from running with a NULL fh_dentry. A remote client can exploit this by crafting a COMPOUND that includes an inter-SSC COPY (which causes check_if_stalefh_allowed() to set no_verify=true on the saved PUTFH) with an additional op inserted between the source PUTFH and SAVEFH. For example, SETATTR calls fh_want_write() which dereferences fh_export->ex_path.mnt without calling fh_verify() first, causing a NULL pointer dereference in the nfsd kthread. Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow) and ops with ALLOWED_WITHOUT_FH (which don't need a resolved filehandle) may proceed. All other ops receive nfserr_stale, per RFC 7862 Section 15.2.3 which specifies that foreign filehandle validation is deferred to the consuming operation and NFS4ERR_STALE returned at that point.

Affected packages

Ecosystem Package Introduced Fixed