GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89705 (GCVE-0-2026-89705)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch() sets rq_status_counter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-lock like protocol with the lockless reader in nfsd_nl_rpc_status_get_dumpit(). Only the fully successful path restored the counter to even. The cache-hit (RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return after the odd-valued store without ever bringing the counter back to even. Once one of those paths is taken, rq_status_counter is left odd: the next request's decode ORs in 1 (still odd) and only a subsequent successful encode restores even. While stuck odd, the dumpit reader treats the rqstp fields as stable and its retry check compares against the same unchanging odd value, so it never detects concurrent mutation. This exposes actively mutating fields (e.g. args->ops / args->opcnt during compound decode and release) to the lockless reader, which can read past the end of the 8-element inline ops array. Add a helper that advances the counter to the next even value and call it on every return path that follows the odd-valued store. The decode-error path is left untouched as it is reached before the counter is set odd.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bd9d6a3efa9709e653aafbeb859289feccb8e70c , < b08c30f08d57f30699d36809d92f0b683dca261f (git)
Affected: bd9d6a3efa9709e653aafbeb859289feccb8e70c , < f6045886fe3f14f269f683d64021b004a50d0efa (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfssvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b08c30f08d57f30699d36809d92f0b683dca261f",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "f6045886fe3f14f269f683d64021b004a50d0efa",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfssvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths\n\nnfsd_dispatch() sets rq_status_counter to an odd value once a request has\nbeen decoded, and back to an even value once it has been fully processed,\nforming a seq-lock like protocol with the lockless reader in\nnfsd_nl_rpc_status_get_dumpit().\n\nOnly the fully successful path restored the counter to even. The cache-hit\n(RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return\nafter the odd-valued store without ever bringing the counter back to even.\nOnce one of those paths is taken, rq_status_counter is left odd: the next\nrequest\u0027s decode ORs in 1 (still odd) and only a subsequent successful\nencode restores even. While stuck odd, the dumpit reader treats the rqstp\nfields as stable and its retry check compares against the same unchanging\nodd value, so it never detects concurrent mutation. This exposes actively\nmutating fields (e.g. args-\u003eops / args-\u003eopcnt during compound decode and\nrelease) to the lockless reader, which can read past the end of the\n8-element inline ops array.\n\nAdd a helper that advances the counter to the next even value and call it\non every return path that follows the odd-valued store. The decode-error\npath is left untouched as it is reached before the counter is set odd."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The confidentiality and availability impact is in nfsd_nl_rpc_status_get_dumpit(), reached only via NFSD_CMD_RPC_STATUS_GET over AF_NETLINK. Remote NFS RPCs can leave rq_status_counter odd in nfsd_dispatch() but never enter dumpit, so exploitation requires local netlink access.\nAC:L - An attacker can send an NFSv4.0 COMPOUND with OP_CACHEME (SETCLIENTID) and a duplicate in-flight RPC so nfsd_cache_lookup() returns RC_DROPIT, leaving rq_status_counter stuck odd. Later compounds with more than eight ops then let dumpit observe opcnt/ops mid-decode with no seqlock retry; both sides are attacker-controlled.\nPR:L - NFSD_CMD_RPC_STATUS_GET is registered with GENL_CMD_CAP_DUMP and no GENL_ADMIN_PERM, so any unprivileged process in the nfsd network namespace can invoke the dump. Exploitation does not require CAP_NET_ADMIN or init-namespace root.\nUI:N - The attacker issues the netlink dump and the NFSv4 compounds themselves. No separate victim action such as mounting a filesystem or opening a device is required.\nS:U - The slab over-read and netlink leak occur in host-kernel nfsd on the local machine. Impact stays inside one security authority and is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - With the counter stuck odd, dumpit treats mutating args-\u003eops/opcnt as stable and reads min(opcnt,16) slots. When opcnt is set above eight before ops is switched off iops[8], indices 8-15 load adjacent slab at nfsd4_op stride and return those u32s via NFSD_A_RPC_STATUS_COMPOUND_OPS.\nI:N - dumpit only loads opnum into a stack nfsd_genl_rqstp for netlink. This seqlock bug yields an out-of-bounds read, not an out-of-bounds write, use-after-free write primitive, or control-flow hijack.\nA:H - Slots 8-15 are sampled at sizeof(struct nfsd4_op) stride past the trailing iops[8] array in kmalloc\u0027d nfsd4_compoundargs into adjacent or unmapped slab pages, which can oops the dumpit path even if the leak is not turned into a stable read."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:27.334Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b08c30f08d57f30699d36809d92f0b683dca261f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6045886fe3f14f269f683d64021b004a50d0efa"
        }
      ],
      "title": "nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89705",
    "datePublished": "2026-09-11T19:46:21.832Z",
    "dateReserved": "2026-09-11T19:38:34.750Z",
    "dateUpdated": "2026-09-13T06:33:27.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89705",
      "date": "2026-09-15",
      "epss": "0.0015",
      "percentile": "0.04494"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89705\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:57.780\",\"lastModified\":\"2026-09-13T07:17:36.127\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths\\n\\nnfsd_dispatch() sets rq_status_counter to an odd value once a request has\\nbeen decoded, and back to an even value once it has been fully processed,\\nforming a seq-lock like protocol with the lockless reader in\\nnfsd_nl_rpc_status_get_dumpit().\\n\\nOnly the fully successful path restored the counter to even. The cache-hit\\n(RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return\\nafter the odd-valued store without ever bringing the counter back to even.\\nOnce one of those paths is taken, rq_status_counter is left odd: the next\\nrequest\u0027s decode ORs in 1 (still odd) and only a subsequent successful\\nencode restores even. While stuck odd, the dumpit reader treats the rqstp\\nfields as stable and its retry check compares against the same unchanging\\nodd value, so it never detects concurrent mutation. This exposes actively\\nmutating fields (e.g. args-\u003eops / args-\u003eopcnt during compound decode and\\nrelease) to the lockless reader, which can read past the end of the\\n8-element inline ops array.\\n\\nAdd a helper that advances the counter to the next even value and call it\\non every return path that follows the odd-valued store. The decode-error\\npath is left untouched as it is reached before the counter is set odd.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfssvc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bd9d6a3efa9709e653aafbeb859289feccb8e70c\",\"lessThan\":\"b08c30f08d57f30699d36809d92f0b683dca261f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bd9d6a3efa9709e653aafbeb859289feccb8e70c\",\"lessThan\":\"f6045886fe3f14f269f683d64021b004a50d0efa\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfssvc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b08c30f08d57f30699d36809d92f0b683dca261f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f6045886fe3f14f269f683d64021b004a50d0efa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T12:46:50+00:00",
      "cve": "CVE-2026-89705",
      "id": "CVE-2026-89705",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "199",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89705.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T23:59:47Z",
      "cve": "CVE-2026-89705",
      "id": "CVE-2026-89705",
      "initial_release_date": "2026-09-12T16:23:16Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89705",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89705.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.