GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89664 (GCVE-0-2026-89664)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:32
VLAI
Title
nfsd: release OPEN-decoded posix ACLs via op_release
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via op_release nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates refcounted struct posix_acl objects via posix_acl_alloc() and stores them in open->op_pacl and open->op_dpacl. These pointers must be released once the OPEN compound finishes. When nfsd4_decode_open_claim4() returns a non-seqid-mutating error, the dispatcher short-circuits before op_func runs: nfsd4_proc_compound() if (op->status && op->opnum == OP_OPEN) op->status = nfsd4_open_omfg(...) if (!seqid_mutating_err(ntohl(op->status))) return op->status; /* nfsd4_open() never runs */ ... opdesc->op_release(&op->u) /* must still release op_pacl/op_dpacl */ Before this change OP_OPEN had no .op_release in nfsd4_ops[], and the release pair lived inside nfsd4_open() at its out_err: label. On the short-circuit path nfsd4_open() is never invoked, so both posix_acl refs leak on every malformed OPEN compound that carries valid POSIX ACL createhow4 attributes. Add nfsd4_open_release() and wire it as .op_release for OP_OPEN. posix_acl_release() is NULL-safe, so the single release site covers both the normal path and the nfsd4_open_omfg short-circuit. Remove the matching posix_acl_release() pair from nfsd4_open()'s out_err: label to avoid double-releasing. The compound loop has two encoding branches: nfsd4_encode_operation() for normal ops, and nfsd4_encode_replay() for v4.0 replayed ops. op_release was only called from nfsd4_encode_operation(), so resources attached to op->u leak on the replay path. Move the op_release() call out of nfsd4_encode_operation() and the replay branch, placing it after the if-else in nfsd4_proc_compound(). This gives a single call site in a fairly obviously-correct place, covering both the normal encoding and replay paths.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 , < 5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921 (git)
Affected: 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 , < 8215892993ea9f5231da4fa9eb42428a286fce8b (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921",
              "status": "affected",
              "version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05",
              "versionType": "git"
            },
            {
              "lessThan": "8215892993ea9f5231da4fa9eb42428a286fce8b",
              "status": "affected",
              "version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release OPEN-decoded posix ACLs via op_release\n\nnfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates\nrefcounted struct posix_acl objects via posix_acl_alloc() and stores\nthem in open-\u003eop_pacl and open-\u003eop_dpacl. These pointers must be\nreleased once the OPEN compound finishes.\n\nWhen nfsd4_decode_open_claim4() returns a non-seqid-mutating error,\nthe dispatcher short-circuits before op_func runs:\n\n    nfsd4_proc_compound()\n      if (op-\u003estatus \u0026\u0026 op-\u003eopnum == OP_OPEN)\n          op-\u003estatus = nfsd4_open_omfg(...)\n              if (!seqid_mutating_err(ntohl(op-\u003estatus)))\n                  return op-\u003estatus;   /* nfsd4_open() never runs */\n      ...\n      opdesc-\u003eop_release(\u0026op-\u003eu)  /* must still release op_pacl/op_dpacl */\n\nBefore this change OP_OPEN had no .op_release in nfsd4_ops[], and the\nrelease pair lived inside nfsd4_open() at its out_err: label. On the\nshort-circuit path nfsd4_open() is never invoked, so both posix_acl\nrefs leak on every malformed OPEN compound that carries valid POSIX\nACL createhow4 attributes.\n\nAdd nfsd4_open_release() and wire it as .op_release for OP_OPEN.\nposix_acl_release() is NULL-safe, so the single release site covers\nboth the normal path and the nfsd4_open_omfg short-circuit. Remove\nthe matching posix_acl_release() pair from nfsd4_open()\u0027s out_err:\nlabel to avoid double-releasing.\n\nThe compound loop has two encoding branches: nfsd4_encode_operation()\nfor normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.\nop_release was only called from nfsd4_encode_operation(), so resources\nattached to op-\u003eu leak on the replay path.\n\nMove the op_release() call out of nfsd4_encode_operation() and the\nreplay branch, placing it after the if-else in nfsd4_proc_compound().\nThis gives a single call site in a fairly obviously-correct place,\ncovering both the normal encoding and replay paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The leak is in nfsd NFSv4 OPEN XDR decoding (nfsd4_decode_createhow4 \u2192 nfsd4_decode_fattr4 \u2192 posix_acl_alloc), reached over the network via COMPOUND RPCs on TCP/UDP port 2049 when the in-kernel NFS server is running.\nAC:L - An attacker can deterministically leak the ACLs by sending OPEN with CREATE and valid POSIX ACL attributes, then a non-seqid-mutating decode error such as NFS4ERR_BADXDR on open_claim4, so nfsd4_open() never runs; no race or luck is required.\nPR:N - OPEN decode allocates the posix_acl objects after spoofable RPC AUTH_UNIX and before nfsd4_open(), fh_verify(), export permission checks, or clientid/session validation, so no authenticated NFS identity or local account on the server is required.\nUI:N - The attacker triggers the leak solely by sending crafted NFSv4 COMPOUND packets; no victim user must mount a filesystem, open a file, or take any other action.\nS:U - Impact is confined to kernel slab consumption on the NFS server host and does not cross a VM, guest, sandbox, or IOMMU security boundary.\nC:N - This is a refcount leak of attacker-supplied posix_acl allocations with no out-of-bounds read, use-after-free, or other primitive that could disclose kernel or file data.\nI:N - The short-circuit path never runs nfsd4_open() or writes file/ACL metadata; the only effect is orphaned kmalloc objects, with no memory corruption or unauthorized modification.\nA:H - Each malformed OPEN permanently leaks up to two posix_acl objects (NFS_ACL_MAX_ENTRIES=1024, about 16KB each) for the server lifetime; repeating the request exhausts kernel memory and can OOM the NFS server and co-hosted workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:46.562Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921"
        },
        {
          "url": "https://git.kernel.org/stable/c/8215892993ea9f5231da4fa9eb42428a286fce8b"
        }
      ],
      "title": "nfsd: release OPEN-decoded posix ACLs via op_release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89664",
    "datePublished": "2026-09-11T19:45:51.319Z",
    "dateReserved": "2026-09-11T19:38:34.745Z",
    "dateUpdated": "2026-09-13T06:32:46.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89664",
      "date": "2026-09-15",
      "epss": "0.00488",
      "percentile": "0.4063"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89664\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:52.790\",\"lastModified\":\"2026-09-13T07:17:32.047\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: release OPEN-decoded posix ACLs via op_release\\n\\nnfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates\\nrefcounted struct posix_acl objects via posix_acl_alloc() and stores\\nthem in open-\u003eop_pacl and open-\u003eop_dpacl. These pointers must be\\nreleased once the OPEN compound finishes.\\n\\nWhen nfsd4_decode_open_claim4() returns a non-seqid-mutating error,\\nthe dispatcher short-circuits before op_func runs:\\n\\n    nfsd4_proc_compound()\\n      if (op-\u003estatus \u0026\u0026 op-\u003eopnum == OP_OPEN)\\n          op-\u003estatus = nfsd4_open_omfg(...)\\n              if (!seqid_mutating_err(ntohl(op-\u003estatus)))\\n                  return op-\u003estatus;   /* nfsd4_open() never runs */\\n      ...\\n      opdesc-\u003eop_release(\u0026op-\u003eu)  /* must still release op_pacl/op_dpacl */\\n\\nBefore this change OP_OPEN had no .op_release in nfsd4_ops[], and the\\nrelease pair lived inside nfsd4_open() at its out_err: label. On the\\nshort-circuit path nfsd4_open() is never invoked, so both posix_acl\\nrefs leak on every malformed OPEN compound that carries valid POSIX\\nACL createhow4 attributes.\\n\\nAdd nfsd4_open_release() and wire it as .op_release for OP_OPEN.\\nposix_acl_release() is NULL-safe, so the single release site covers\\nboth the normal path and the nfsd4_open_omfg short-circuit. Remove\\nthe matching posix_acl_release() pair from nfsd4_open()\u0027s out_err:\\nlabel to avoid double-releasing.\\n\\nThe compound loop has two encoding branches: nfsd4_encode_operation()\\nfor normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.\\nop_release was only called from nfsd4_encode_operation(), so resources\\nattached to op-\u003eu leak on the replay path.\\n\\nMove the op_release() call out of nfsd4_encode_operation() and the\\nreplay branch, placing it after the if-else in nfsd4_proc_compound().\\nThis gives a single call site in a fairly obviously-correct place,\\ncovering both the normal encoding and replay paths.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\",\"fs/nfsd/nfs4xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05\",\"lessThan\":\"5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05\",\"lessThan\":\"8215892993ea9f5231da4fa9eb42428a286fce8b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\",\"fs/nfsd/nfs4xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8215892993ea9f5231da4fa9eb42428a286fce8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T11:02:24+00:00",
      "cve": "CVE-2026-89664",
      "id": "CVE-2026-89664",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: release OPEN-decoded posix ACLs via op_release",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89664.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:47Z",
      "cve": "CVE-2026-89664",
      "id": "CVE-2026-89664",
      "initial_release_date": "2026-09-12T16:24:02Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89664",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89664.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.