---
id: CVE-2026-89677
title: 'nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

  dentry_create() can hypothetically provide a different dentry than the
  one passed in.  This could …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 64a989dbd144e0622371396461b11335459692d2 <
    033e783709ce99662cf81f6abcad746a8da9d35f
  - >-
    Linux >= 64a989dbd144e0622371396461b11335459692d2 <
    3e2c79360c6a89975ec5b5a7d4ef937e4db91a27
  - Linux 7.0
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:50.591Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89677'
references:
  - url: 'https://git.kernel.org/stable/c/033e783709ce99662cf81f6abcad746a8da9d35f'
  - url: 'https://git.kernel.org/stable/c/3e2c79360c6a89975ec5b5a7d4ef937e4db91a27'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89677.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89677'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532419'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89677'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89677'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89677.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00553
epssPercentile: 0.46014
scores:
  cna: 9.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

dentry_create() can hypothetically provide a different dentry than the
one passed in.  This could happen, for example, if the exported
filesystem is NFS, and the server returned to OPEN a filehandle which
matched a directory that was already in the dcache.  Clearly this would
not be expected!

If this were to happen the dentry (child) that was already stored in
resfhp could be freed and later dereferenced.

We shouldn't call fh_compose() until we are certain that we have the
final dentry, so this patch moved the fh_compose() call to two places:
one for the case where the target already exists, and one after
dentry_create() where it was created.

## Affected

- `Linux >= 64a989dbd144e0622371396461b11335459692d2 < 033e783709ce99662cf81f6abcad746a8da9d35f`
- `Linux >= 64a989dbd144e0622371396461b11335459692d2 < 3e2c79360c6a89975ec5b5a7d4ef937e4db91a27`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89677.json)