GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89679 (GCVE-0-2026-89679)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr() sets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate the stateid. If the client supplies the NFSv4 "one stateid" (all-0xFF bytes), check_special_stateids() returns nfs_ok without populating the output nfs4_stid pointer, because the special-stateid path in nfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the "if (s)" block that would set *cstid is skipped. The local variable `st` remains NULL. Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally dereferences st->sc_type (at offset 4 from NULL), causing a kernel oops. This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH, SETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})]. No authentication, delegation, or prior state is required. Fix by adding a NULL check before the dereference. A special stateid is not a delegation stateid, so the existing nfserr_bad_stateid return value is already correct; we only need to guard the pointer dereference itself.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7e13f4f8d27dc02fb88666f603c53ca749d56f92 , < 3c5119b799a7f57db332b2c31e806de16c869f0f (git)
Affected: 7e13f4f8d27dc02fb88666f603c53ca749d56f92 , < 3c896db123892256fd39af0ee8c2d02c63539983 (git)
Affected: 7e13f4f8d27dc02fb88666f603c53ca749d56f92 , < fe456c8c0931bb3e8a03d429920e87fd85747fba (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c5119b799a7f57db332b2c31e806de16c869f0f",
              "status": "affected",
              "version": "7e13f4f8d27dc02fb88666f603c53ca749d56f92",
              "versionType": "git"
            },
            {
              "lessThan": "3c896db123892256fd39af0ee8c2d02c63539983",
              "status": "affected",
              "version": "7e13f4f8d27dc02fb88666f603c53ca749d56f92",
              "versionType": "git"
            },
            {
              "lessThan": "fe456c8c0931bb3e8a03d429920e87fd85747fba",
              "status": "affected",
              "version": "7e13f4f8d27dc02fb88666f603c53ca749d56f92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs\n\nWhen a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or\nFATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr()\nsets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate\nthe stateid.\n\nIf the client supplies the NFSv4 \"one stateid\" (all-0xFF bytes),\ncheck_special_stateids() returns nfs_ok without populating the output\nnfs4_stid pointer, because the special-stateid path in\nnfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the\n\"if (s)\" block that would set *cstid is skipped. The local variable `st`\nremains NULL.\n\nBack in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally\ndereferences st-\u003esc_type (at offset 4 from NULL), causing a kernel oops.\n\nThis is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH,\nSETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})].\nNo authentication, delegation, or prior state is required.\n\nFix by adding a NULL check before the dereference. A special stateid is\nnot a delegation stateid, so the existing nfserr_bad_stateid return value\nis already correct; we only need to guard the pointer dereference itself."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd is the in-kernel NFSv4 server; nfsd4_setattr() is reached from NFSPROC4_COMPOUND over TCP/2049. A remote peer triggers it with PUTROOTFH then SETATTR; no local access to the server is required.\nAC:L - COMPOUND [PUTROOTFH, SETATTR(ONE_STATEID, FATTR4_WORD2_TIME_DELEG_ACCESS)] makes check_special_stateids() return nfs_ok with st still NULL, then nfsd4_setattr() unconditionally reads st-\u003esc_type. The crash is deterministic; no race, special layout, or rare config is required.\nPR:N - The NULL deref runs in nfsd4_setattr() before nfsd_setattr()/nfsd_permission and needs no NFSv4 session, delegation, or prior state (v4.0 COMPOUND). Default AUTH_SYS/AUTH_NULL credentials are self-asserted, so any host that can reach the NFS port can trigger it.\nUI:N - The attacker sends the crafted NFSv4 COMPOUND themselves; no victim must mount an export, open a file, or otherwise interact.\nS:U - The NULL dereference oopses an nfsd thread on the NFS server. Impact stays inside that kernel\u0027s security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - This is a pure NULL-pointer read of st-\u003esc_type at offset 4 from NULL. It oopses without leaking kernel memory or providing an information-disclosure primitive.\nI:N - The bug only reads through a NULL nfs4_stid pointer; it does not write memory, corrupt adjacent objects, or yield a control-flow hijack. A remote NFS client cannot map the NULL page.\nA:H - The NULL dereference causes a kernel oops in the nfsd thread. Repeated requests can exhaust nfsd threads or panic the host (panic_on_oops), denying NFS service and taking down the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:02.395Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c5119b799a7f57db332b2c31e806de16c869f0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c896db123892256fd39af0ee8c2d02c63539983"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe456c8c0931bb3e8a03d429920e87fd85747fba"
        }
      ],
      "title": "nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89679",
    "datePublished": "2026-09-11T19:46:02.833Z",
    "dateReserved": "2026-09-11T19:38:34.747Z",
    "dateUpdated": "2026-09-13T06:33:02.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89679",
      "date": "2026-09-16",
      "epss": "0.00687",
      "percentile": "0.50987"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89679\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:54.660\",\"lastModified\":\"2026-09-13T07:17:33.647\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs\\n\\nWhen a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or\\nFATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr()\\nsets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate\\nthe stateid.\\n\\nIf the client supplies the NFSv4 \\\"one stateid\\\" (all-0xFF bytes),\\ncheck_special_stateids() returns nfs_ok without populating the output\\nnfs4_stid pointer, because the special-stateid path in\\nnfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the\\n\\\"if (s)\\\" block that would set *cstid is skipped. The local variable `st`\\nremains NULL.\\n\\nBack in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally\\ndereferences st-\u003esc_type (at offset 4 from NULL), causing a kernel oops.\\n\\nThis is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH,\\nSETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})].\\nNo authentication, delegation, or prior state is required.\\n\\nFix by adding a NULL check before the dereference. A special stateid is\\nnot a delegation stateid, so the existing nfserr_bad_stateid return value\\nis already correct; we only need to guard the pointer dereference itself.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7e13f4f8d27dc02fb88666f603c53ca749d56f92\",\"lessThan\":\"3c5119b799a7f57db332b2c31e806de16c869f0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e13f4f8d27dc02fb88666f603c53ca749d56f92\",\"lessThan\":\"3c896db123892256fd39af0ee8c2d02c63539983\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e13f4f8d27dc02fb88666f603c53ca749d56f92\",\"lessThan\":\"fe456c8c0931bb3e8a03d429920e87fd85747fba\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3c5119b799a7f57db332b2c31e806de16c869f0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c896db123892256fd39af0ee8c2d02c63539983\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fe456c8c0931bb3e8a03d429920e87fd85747fba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:51:54+00:00",
      "cve": "CVE-2026-89679",
      "id": "CVE-2026-89679",
      "initial_release_date": "2026-09-11T19:46:02.833000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel nfsd: Denial of Service via specially crafted SETATTR request",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89679.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:24Z",
      "cve": "CVE-2026-89679",
      "id": "CVE-2026-89679",
      "initial_release_date": "2026-09-12T16:23:48Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89679",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89679.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.