CVE-2026-89664

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89664", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.745Z", "datePublished": "2026-09-11T19:45:51.319Z", "dateUpdated": "2026-10-19T08:50:35.770Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:50:35.770Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release OPEN-decoded posix ACLs via op_release\n\nnfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates\nrefcounted struct posix_acl objects via posix_acl_alloc() and stores\nthem in open->op_pacl and open->op_dpacl. These pointers must be\nreleased once the OPEN compound finishes.\n\nWhen nfsd4_decode_open_claim4() returns a non-seqid-mutating error,\nthe dispatcher short-circuits before op_func runs:\n\n nfsd4_proc_compound()\n if (op->status && op->opnum == OP_OPEN)\n op->status = nfsd4_open_omfg(...)\n if (!seqid_mutating_err(ntohl(op->status)))\n return op->status; /* nfsd4_open() never runs */\n ...\n opdesc->op_release(&op->u) /* must still release op_pacl/op_dpacl */\n\nBefore this change OP_OPEN had no .op_release in nfsd4_ops[], and the\nrelease pair lived inside nfsd4_open() at its out_err: label. On the\nshort-circuit path nfsd4_open() is never invoked, so both posix_acl\nrefs leak on every malformed OPEN compound that carries valid POSIX\nACL createhow4 attributes.\n\nAdd nfsd4_open_release() and wire it as .op_release for OP_OPEN.\nposix_acl_release() is NULL-safe, so the single release site covers\nboth the normal path and the nfsd4_open_omfg short-circuit. Remove\nthe matching posix_acl_release() pair from nfsd4_open()'s out_err:\nlabel to avoid double-releasing.\n\nThe compound loop has two encoding branches: nfsd4_encode_operation()\nfor normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.\nop_release was only called from nfsd4_encode_operation(), so resources\nattached to op->u leak on the replay path.\n\nMove the op_release() call out of nfsd4_encode_operation() and the\nreplay branch, placing it after the if-else in nfsd4_proc_compound().\nThis gives a single call site in a fairly obviously-correct place,\ncovering both the normal encoding and replay paths."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The leak is in nfsd NFSv4 OPEN XDR decoding (nfsd4_decode_createhow4 \u2192 nfsd4_decode_fattr4 \u2192 posix_acl_alloc), reached over the network via COMPOUND RPCs on TCP/UDP port 2049 when the in-kernel NFS server is running.\nAC:L - An attacker can deterministically leak the ACLs by sending OPEN with CREATE and valid POSIX ACL attributes, then a non-seqid-mutating decode error such as NFS4ERR_BADXDR on open_claim4, so nfsd4_open() never runs; no race or luck is required.\nPR:N - OPEN decode allocates the posix_acl objects after spoofable RPC AUTH_UNIX and before nfsd4_open(), fh_verify(), export permission checks, or clientid/session validation, so no authenticated NFS identity or local account on the server is required.\nUI:N - The attacker triggers the leak solely by sending crafted NFSv4 COMPOUND packets; no victim user must mount a filesystem, open a file, or take any other action.\nS:U - Impact is confined to kernel slab consumption on the NFS server host and does not cross a VM, guest, sandbox, or IOMMU security boundary.\nC:N - This is a refcount leak of attacker-supplied posix_acl allocations with no out-of-bounds read, use-after-free, or other primitive that could disclose kernel or file data.\nI:N - The short-circuit path never runs nfsd4_open() or writes file/ACL metadata; the only effect is orphaned kmalloc objects, with no memory corruption or unauthorized modification.\nA:H - Each malformed OPEN permanently leaks up to two posix_acl objects (NFS_ACL_MAX_ENTRIES=1024, about 16KB each) for the server lifetime; repeating the request exhausts kernel memory and can OOM the NFS server and co-hosted workloads."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4proc.c", "fs/nfsd/nfs4xdr.c"], "versions": [{"version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05", "lessThan": "5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921", "status": "affected", "versionType": "git"}, {"version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05", "lessThan": "8215892993ea9f5231da4fa9eb42428a286fce8b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4proc.c", "fs/nfsd/nfs4xdr.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921"}, {"url": "https://git.kernel.org/stable/c/8215892993ea9f5231da4fa9eb42428a286fce8b"}], "title": "nfsd: release OPEN-decoded posix ACLs via op_release", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4proc.c", "fs/nfsd/nfs4xdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921", "status": "affected", "version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05", "versionType": "git"}, {"lessThan": "8215892993ea9f5231da4fa9eb42428a286fce8b", "status": "affected", "version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4proc.c", "fs/nfsd/nfs4xdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release OPEN-decoded posix ACLs via op_release\n\nnfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates\nrefcounted struct posix_acl objects via posix_acl_alloc() and stores\nthem in open->op_pacl and open->op_dpacl. These pointers must be\nreleased once the OPEN compound finishes.\n\nWhen nfsd4_decode_open_claim4() returns a non-seqid-mutating error,\nthe dispatcher short-circuits before op_func runs:\n\n nfsd4_proc_compound()\n if (op->status && op->opnum == OP_OPEN)\n op->status = nfsd4_open_omfg(...)\n if (!seqid_mutating_err(ntohl(op->status)))\n return op->status; /* nfsd4_open() never runs */\n ...\n opdesc->op_release(&op->u) /* must still release op_pacl/op_dpacl */\n\nBefore this change OP_OPEN had no .op_release in nfsd4_ops[], and the\nrelease pair lived inside nfsd4_open() at its out_err: label. On the\nshort-circuit path nfsd4_open() is never invoked, so both posix_acl\nrefs leak on every malformed OPEN compound that carries valid POSIX\nACL createhow4 attributes.\n\nAdd nfsd4_open_release() and wire it as .op_release for OP_OPEN.\nposix_acl_release() is NULL-safe, so the single release site covers\nboth the normal path and the nfsd4_open_omfg short-circuit. Remove\nthe matching posix_acl_release() pair from nfsd4_open()'s out_err:\nlabel to avoid double-releasing.\n\nThe compound loop has two encoding branches: nfsd4_encode_operation()\nfor normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.\nop_release was only called from nfsd4_encode_operation(), so resources\nattached to op->u leak on the replay path.\n\nMove the op_release() call out of nfsd4_encode_operation() and the\nreplay branch, placing it after the if-else in nfsd4_proc_compound().\nThis gives a single call site in a fairly obviously-correct place,\ncovering both the normal encoding and replay paths."}], "id": "CVE-2026-89664", "lastModified": "2026-10-19T09:18:04.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:52.790", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8215892993ea9f5231da4fa9eb42428a286fce8b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel: nfsd memory leak via malformed NFSv4 OPEN operations", "id": "2532528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532528"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When processing malformed NFSv4 OPEN compound operations that include valid Portable Operating System Interface (POSIX) Access Control List (ACL) attributes, the kernel fails to release allocated memory resources. This oversight can lead to a memory leak, which, over time, could exhaust system memory and result in a Denial of Service (DoS) for affected systems."], "name": "CVE-2026-89664", "public_date": "2026-09-11T19:45:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89664\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89664\nhttps://git.kernel.org/stable/c/5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921\nhttps://git.kernel.org/stable/c/8215892993ea9f5231da4fa9eb42428a286fce8b"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05,5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05,8215892993ea9f5231da4fa9eb42428a286fce8b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T10:00:08.635631+00:00", "updated": "2026-09-15T22:15:17.684293+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}