{"id":"CVE-2026-89696","title":"nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref\n\nWhen CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return\nsuccess with fh_dentry and fh…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-476"],"vendor":"Linux","product":"Linux","affected":["Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32","Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 00c84f4eec715e501efc080a5670114189e42507","Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 2d9846fd1c767920fddd4bde30eb35cd2969df13","Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 977e6f006a7a3ffc4216ae6034f768f8de6fd138","Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 35f248bd40b47b229d4999581df45b97daadd977","Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 311f7d926630940650447cbd1c932b076b40a6c4","Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < bf4d338dc8625d70c7f2cb0657d66851a7ac9154","Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < c59738a00aa51b16adc1b5ceb7c80877168efb4d","Linux 5.6"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:51:09.479Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89696","references":[{"url":"https://git.kernel.org/stable/c/ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32"},{"url":"https://git.kernel.org/stable/c/00c84f4eec715e501efc080a5670114189e42507"},{"url":"https://git.kernel.org/stable/c/2d9846fd1c767920fddd4bde30eb35cd2969df13"},{"url":"https://git.kernel.org/stable/c/977e6f006a7a3ffc4216ae6034f768f8de6fd138"},{"url":"https://git.kernel.org/stable/c/35f248bd40b47b229d4999581df45b97daadd977"},{"url":"https://git.kernel.org/stable/c/311f7d926630940650447cbd1c932b076b40a6c4"},{"url":"https://git.kernel.org/stable/c/bf4d338dc8625d70c7f2cb0657d66851a7ac9154"},{"url":"https://git.kernel.org/stable/c/c59738a00aa51b16adc1b5ceb7c80877168efb4d"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89696.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89696"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532408"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89696"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89696"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89696.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00752,"epssPercentile":0.54837,"scores":{"cna":7.5,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.449Z","slug":"CVE-2026-89696","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref\n\nWhen CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return\nsuccess with fh_dentry and fh_export both NULL if fh_verify() returns\nnfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag\nis set, but the compound dispatch loop only uses this flag to bypass\nthe nfserr_nofilehandle check -- it does not prevent subsequent ops\nfrom running with a NULL fh_dentry.\n\nA remote client can exploit this by crafting a COMPOUND that includes\nan inter-SSC COPY (which causes check_if_stalefh_allowed() to set\nno_verify=true on the saved PUTFH) with an additional op inserted\nbetween the source PUTFH and SAVEFH. For example, SETATTR calls\nfh_want_write() which dereferences fh_export->ex_path.mnt without\ncalling fh_verify() first, causing a NULL pointer dereference in the\nnfsd kthread.\n\nFix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set\nand fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow)\nand ops with ALLOWED_WITHOUT_FH (which don't need a resolved\nfilehandle) may proceed. All other ops receive nfserr_stale, per\nRFC 7862 Section 15.2.3 which specifies that foreign filehandle\nvalidation is deferred to the consuming operation and NFS4ERR_STALE\nreturned at that point.\n\n## Affected\n\n- `Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32`\n- `Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 00c84f4eec715e501efc080a5670114189e42507`\n- `Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 2d9846fd1c767920fddd4bde30eb35cd2969df13`\n- `Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 977e6f006a7a3ffc4216ae6034f768f8de6fd138`\n- `Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 35f248bd40b47b229d4999581df45b97daadd977`\n- `Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < 311f7d926630940650447cbd1c932b076b40a6c4`\n- `Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < bf4d338dc8625d70c7f2cb0657d66851a7ac9154`\n- `Linux >= b9e8638e3d9ed8334f1f7071e081860aac37e83e < c59738a00aa51b16adc1b5ceb7c80877168efb4d`\n- `Linux 5.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89696.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":224611,"id":"CVE-2026-89696","ts":1792401437117,"field":"cvss","old":"5.5","new":"7.5"},{"seq":224610,"id":"CVE-2026-89696","ts":1792401437117,"field":"severity","old":"medium","new":"high"},{"seq":208460,"id":"CVE-2026-89696","ts":1790005707150,"field":"cvss","old":"7.5","new":"5.5"},{"seq":208459,"id":"CVE-2026-89696","ts":1790005707150,"field":"severity","old":"high","new":"medium"},{"seq":197728,"id":"CVE-2026-89696","ts":1789384318583,"field":"cvss","old":"5.9","new":"7.5"},{"seq":197727,"id":"CVE-2026-89696","ts":1789384318583,"field":"severity","old":"medium","new":"high"},{"seq":183702,"id":"CVE-2026-89696","ts":1789356677018,"field":"cvss","old":"7.5","new":"5.9"},{"seq":183701,"id":"CVE-2026-89696","ts":1789356677018,"field":"severity","old":"high","new":"medium"},{"seq":153578,"id":"CVE-2026-89696","ts":1789285351356,"field":"cvss","old":null,"new":"7.5"},{"seq":153577,"id":"CVE-2026-89696","ts":1789285351356,"field":"severity","old":"none","new":"high"},{"seq":147251,"id":"CVE-2026-89696","ts":1789270204499,"field":"cvss","old":null,"new":"5.9"},{"seq":147250,"id":"CVE-2026-89696","ts":1789270204499,"field":"severity","old":"none","new":"medium"},{"seq":109000,"id":"CVE-2026-89696","ts":1789183729901,"field":"cvss","old":null,"new":"5.9"},{"seq":108999,"id":"CVE-2026-89696","ts":1789183729901,"field":"severity","old":"none","new":"medium"}]}