CVE-2026-89696

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return

success with fh_dentry and fh_export both NULL if fh_verify() returns

nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag

is set, but the compound dispatch loop only uses this flag to bypass

the nfserr_nofilehandle check -- it does not prevent subsequent ops

from running with a NULL fh_dentry.

A remote client can exploit this by crafting a COMPOUND that includes

an inter-SSC COPY (which causes check_if_stalefh_allowed() to set

no_verify=true on the saved PUTFH) with an additional op inserted

between the source PUTFH and SAVEFH. For example, SETATTR calls

fh_want_write() which dereferences fh_export->ex_path.mnt without

calling fh_verify() first, causing a NULL pointer dereference in the

nfsd kthread.

Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References