CRITICAL Introduced in 7.0
nfsd FileHandle UAF
CVE-2026-89677
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server returned to OPEN a filehandle which matched a directory that was already in the dcache. Clearly this would not be expected! If this were to happen the dentry (child) that was already stored in resfhp could be freed and later dereferenced. We shouldn't call fh_compose() until we are certain that we have the final dentry, so this patch moved the fh_compose() call to two places: one for the case where the target already exists, and one after dentry_create() where it was created.
02KernelScan AI Analysis
Risk summary
An NFS client sending crafted NFSv4 CREATE/OPEN requests to a knfsd server can trigger a use-after-free on a dentry object when the underlying filesystem returns an unexpected dentry during file creation. This could lead to kernel memory corruption, information disclosure, or a system crash. The risk is highest for NFS servers that export filesystems where the create path may substitute dentries (such as NFS-over-NFS re-exports).
Vulnerability analysis
In the NFSv4 file creation path, the server builds a file handle from a directory entry before the file is actually created. If the underlying filesystem returns a different directory entry than expected — for example, when the exported filesystem is itself NFS and a returned file handle matches an existing cached directory — the original directory entry stored in the response may be freed while still referenced, leading to a use-after-free. The fix delays building the file handle until the final directory entry is confirmed, doing so once when the target already exists and again after successful creation. An attacker who can send NFSv4 requests to the server can trigger this, though the specific condition requires the exported filesystem to return an unexpected directory entry during the create path, which is uncommon.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.4 | 033e783709ce |
| mainline | 7.0 | 7.3-rc1 | 3e2c79360c6a |