---
id: CVE-2026-89664
title: 'nfsd: release OPEN-decoded posix ACLs via op_release'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: release OPEN-decoded posix ACLs via op_release

  nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates
  refcounted struct posix_acl objects via pos…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-911
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 <
    5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921
  - >-
    Linux >= 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 <
    8215892993ea9f5231da4fa9eb42428a286fce8b
  - Linux 7.0
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:35.770Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89664'
references:
  - url: 'https://git.kernel.org/stable/c/5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921'
  - url: 'https://git.kernel.org/stable/c/8215892993ea9f5231da4fa9eb42428a286fce8b'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89664.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89664'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532528'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89664'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89664'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89664.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00488
epssPercentile: 0.41799
scores:
  cna: 7.5
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release OPEN-decoded posix ACLs via op_release

nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates
refcounted struct posix_acl objects via posix_acl_alloc() and stores
them in open->op_pacl and open->op_dpacl. These pointers must be
released once the OPEN compound finishes.

When nfsd4_decode_open_claim4() returns a non-seqid-mutating error,
the dispatcher short-circuits before op_func runs:

    nfsd4_proc_compound()
      if (op->status && op->opnum == OP_OPEN)
          op->status = nfsd4_open_omfg(...)
              if (!seqid_mutating_err(ntohl(op->status)))
                  return op->status;   /* nfsd4_open() never runs */
      ...
      opdesc->op_release(&op->u)  /* must still release op_pacl/op_dpacl */

Before this change OP_OPEN had no .op_release in nfsd4_ops[], and the
release pair lived inside nfsd4_open() at its out_err: label. On the
short-circuit path nfsd4_open() is never invoked, so both posix_acl
refs leak on every malformed OPEN compound that carries valid POSIX
ACL createhow4 attributes.

Add nfsd4_open_release() and wire it as .op_release for OP_OPEN.
posix_acl_release() is NULL-safe, so the single release site covers
both the normal path and the nfsd4_open_omfg short-circuit. Remove
the matching posix_acl_release() pair from nfsd4_open()'s out_err:
label to avoid double-releasing.

The compound loop has two encoding branches: nfsd4_encode_operation()
for normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.
op_release was only called from nfsd4_encode_operation(), so resources
attached to op->u leak on the replay path.

Move the op_release() call out of nfsd4_encode_operation() and the
replay branch, placing it after the if-else in nfsd4_proc_compound().
This gives a single call site in a fairly obviously-correct place,
covering both the normal encoding and replay paths.

## Affected

- `Linux >= 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 < 5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921`
- `Linux >= 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 < 8215892993ea9f5231da4fa9eb42428a286fce8b`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89664.json)