CVE-2026-89687

Received Received - Intake

Use-After-Free in Linux Kernel NFS Daemon

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permitted to return success without actually opening the file. It indicates this by calling finish_no_open(). This means dentry_create() can return a file which hasn't been opened. This is extremely unlikely as ->atomic_open handlers typically use finish_no_open() only for already existing files, and dentry_create() isn't called in that case, and the parent being locked should prevent races. However out of an abundance of caution it seems wise to teach nfsd to only use the file returned by dentry_create() if FMODE_OPENED is set, indicating that it has in fact been opened.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89687

EUVD

EUVD-2026-76599

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the NFS server (nfsd) where a file operation may proceed without the file being properly opened. The issue arises because the atomic_open function can return success without actually opening the file, leading to potential misuse of unopened file handles.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS daemon (nfsd) and may not have direct detection commands. Monitor kernel logs for NFS-related errors or crashes. Check if your kernel version includes the fix by running uname -a and comparing against patched versions.

Impact Analysis

This vulnerability could allow an attacker to manipulate file operations on a system running the affected Linux kernel, potentially leading to unauthorized access, data corruption, or denial of service. Systems using NFS for file sharing are particularly at risk.

Compliance Impact

This vulnerability in the Linux kernel's NFS daemon (nfsd) could potentially lead to unauthorized file access or data exposure if exploited. For compliance with GDPR or HIPAA, such vulnerabilities may violate requirements for data integrity and confidentiality, depending on system configuration and use case.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this NFS vulnerability. If immediate patching is not possible, consider disabling NFS services temporarily until the update is applied.

Hi! I’m here to help you understand CVE-2026-89687. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70