CVE-2026-89696 in Linux
Summary
by MITRE • 09/12/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh_export both NULL if fh_verify() returns nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag is set, but the compound dispatch loop only uses this flag to bypass the nfserr_nofilehandle check -- it does not prevent subsequent ops from running with a NULL fh_dentry.
A remote client can exploit this by crafting a COMPOUND that includes an inter-SSC COPY (which causes check_if_stalefh_allowed() to set no_verify=true on the saved PUTFH) with an additional op inserted between the source PUTFH and SAVEFH. For example, SETATTR calls fh_want_write() which dereferences fh_export->ex_path.mnt without calling fh_verify() first, causing a NULL pointer dereference in the nfsd kthread.
Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow) and ops with ALLOWED_WITHOUT_FH (which don't need a resolved filehandle) may proceed. All other ops receive nfserr_stale, per RFC 7862 Section 15.2.3 which specifies that foreign filehandle validation is deferred to the consuming operation and NFS4ERR_STALE returned at that point.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in the Linux kernel's Network File System daemon (nfsd) component represents a critical logic flaw within the handling of NFSv4 compound operations, specifically affecting configurations where inter-Server-Side-Copy is enabled via CONFIG_NFSD_V4_2_INTER_SSC. This issue stems from an incomplete state management mechanism when processing foreign file handles during complex multi-operation sequences. The core technical deficiency lies in how nfsd4_putfh() manages the internal representation of a file handle after verification fails under specific conditions. When fh_verify() returns an error indicating that the file handle is stale, and the putfh structure indicates no further verification is required due to the foreign nature of the object, the function may return success while leaving both fh_dentry and fh_export as NULL pointers. Although the NFSD4_FH_FOREIGN flag is correctly set to indicate a foreign context, this flag alone was insufficient to prevent subsequent operations in the compound from executing with these nullified internal structures.
The operational impact of this flaw allows for a remote denial-of-service attack against NFS servers that support inter-SSC functionality. An attacker can craft a malicious COMPOUND request containing an inter-SSC COPY operation alongside other commands inserted between the source PUTFH and SAVEFH instructions. For instance, including a SETATTR command triggers calls to fh_want_write(), which attempts to access file system mount points by dereferencing fh_export->ex_path.mnt. Because fh_verify() was bypassed or deemed unnecessary for this foreign handle, fh_export remains NULL. Consequently, the kernel thread handling the NFS request encounters a null pointer dereference when attempting to resolve these paths. This results in an immediate crash of the nfsd process, leading to service disruption for all clients connected to that server instance. The vulnerability effectively transforms a standard file system operation into a vector for causing kernel-level instability through simple network requests without requiring authentication or elevated privileges beyond valid NFS session access.
From a classification perspective, this flaw aligns with CWE-476, which denotes NULL Pointer Dereference vulnerabilities arising from improper checks of return values or state conditions before accessing memory pointers. In the context of the MITRE ATT&CK framework for enterprise security, this vulnerability facilitates Denial of Service (T1499) by exploiting application logic errors to crash critical infrastructure services. The attack vector is remote and network-based, making it particularly dangerous in environments where NFS servers are exposed to untrusted networks or compromised clients. The root cause is not a lack of input validation per se, but rather an incomplete implementation of the state machine governing file handle validity across multiple operations within a single compound request.
The resolution implemented by the Linux kernel maintainers addresses this issue by introducing stricter gating logic within the compound dispatch loop. When the NFSD4_FH_FOREIGN flag is active and fh_dentry is NULL, the system now restricts allowed operations to only OP_SAVEFH, which is essential for preserving state in inter-SSC workflows, and any operation explicitly marked as ALLOWED_WITHOUT_FH that does not require a resolved file handle. All other operations are rejected with nfserr_stale error codes. This approach adheres strictly to RFC 7862 Section 15.2.3, which mandates that validation of foreign file handles should be deferred until the actual consuming operation attempts to use them, at which point NFS4ERR_STALE is returned if invalid. By enforcing this restriction, the kernel prevents any intermediate operations from accessing null pointers while maintaining compatibility with legitimate inter-SSC copy procedures.
To mitigate risks associated with similar vulnerabilities in legacy systems or before patch deployment, administrators should consider disabling CONFIG_NFSD_V4_2_INTER_SSC if inter-server copying is not actively required for their storage architecture. This reduces the attack surface by removing the code path that exhibits this specific logic error. Additionally, deploying network-level access controls to restrict NFS traffic to trusted clients can prevent exploitation attempts from untrusted sources. Regularly updating kernel packages and applying vendor-provided security patches remains the most effective defense against such remote denial-of-service vulnerabilities in distributed file system services.