---
id: CVE-2026-89679
title: 'nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

  When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or
  FATTR4_WORD2_TIME_DELEG_MODIFY …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7e13f4f8d27dc02fb88666f603c53ca749d56f92 <
    3c5119b799a7f57db332b2c31e806de16c869f0f
  - >-
    Linux >= 7e13f4f8d27dc02fb88666f603c53ca749d56f92 <
    3c896db123892256fd39af0ee8c2d02c63539983
  - >-
    Linux >= 7e13f4f8d27dc02fb88666f603c53ca749d56f92 <
    fe456c8c0931bb3e8a03d429920e87fd85747fba
  - Linux 6.14
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:52.556Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89679'
references:
  - url: 'https://git.kernel.org/stable/c/3c5119b799a7f57db332b2c31e806de16c869f0f'
  - url: 'https://git.kernel.org/stable/c/3c896db123892256fd39af0ee8c2d02c63539983'
  - url: 'https://git.kernel.org/stable/c/fe456c8c0931bb3e8a03d429920e87fd85747fba'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89679.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89679'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532085'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89679'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89679'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89679.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00718
epssPercentile: 0.53639
scores:
  cna: 7.5
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or
FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr()
sets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate
the stateid.

If the client supplies the NFSv4 "one stateid" (all-0xFF bytes),
check_special_stateids() returns nfs_ok without populating the output
nfs4_stid pointer, because the special-stateid path in
nfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the
"if (s)" block that would set *cstid is skipped. The local variable `st`
remains NULL.

Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally
dereferences st->sc_type (at offset 4 from NULL), causing a kernel oops.

This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH,
SETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})].
No authentication, delegation, or prior state is required.

Fix by adding a NULL check before the dereference. A special stateid is
not a delegation stateid, so the existing nfserr_bad_stateid return value
is already correct; we only need to guard the pointer dereference itself.

## Affected

- `Linux >= 7e13f4f8d27dc02fb88666f603c53ca749d56f92 < 3c5119b799a7f57db332b2c31e806de16c869f0f`
- `Linux >= 7e13f4f8d27dc02fb88666f603c53ca749d56f92 < 3c896db123892256fd39af0ee8c2d02c63539983`
- `Linux >= 7e13f4f8d27dc02fb88666f603c53ca749d56f92 < fe456c8c0931bb3e8a03d429920e87fd85747fba`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89679.json)