GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89696 (GCVE-0-2026-89696)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh_export both NULL if fh_verify() returns nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag is set, but the compound dispatch loop only uses this flag to bypass the nfserr_nofilehandle check -- it does not prevent subsequent ops from running with a NULL fh_dentry. A remote client can exploit this by crafting a COMPOUND that includes an inter-SSC COPY (which causes check_if_stalefh_allowed() to set no_verify=true on the saved PUTFH) with an additional op inserted between the source PUTFH and SAVEFH. For example, SETATTR calls fh_want_write() which dereferences fh_export->ex_path.mnt without calling fh_verify() first, causing a NULL pointer dereference in the nfsd kthread. Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow) and ops with ALLOWED_WITHOUT_FH (which don't need a resolved filehandle) may proceed. All other ops receive nfserr_stale, per RFC 7862 Section 15.2.3 which specifies that foreign filehandle validation is deferred to the consuming operation and NFS4ERR_STALE returned at that point.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b9e8638e3d9ed8334f1f7071e081860aac37e83e , < ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32 (git)
Affected: b9e8638e3d9ed8334f1f7071e081860aac37e83e , < 00c84f4eec715e501efc080a5670114189e42507 (git)
Affected: b9e8638e3d9ed8334f1f7071e081860aac37e83e , < 2d9846fd1c767920fddd4bde30eb35cd2969df13 (git)
Affected: b9e8638e3d9ed8334f1f7071e081860aac37e83e , < 977e6f006a7a3ffc4216ae6034f768f8de6fd138 (git)
Affected: b9e8638e3d9ed8334f1f7071e081860aac37e83e , < 35f248bd40b47b229d4999581df45b97daadd977 (git)
Affected: b9e8638e3d9ed8334f1f7071e081860aac37e83e , < 311f7d926630940650447cbd1c932b076b40a6c4 (git)
Affected: b9e8638e3d9ed8334f1f7071e081860aac37e83e , < bf4d338dc8625d70c7f2cb0657d66851a7ac9154 (git)
Affected: b9e8638e3d9ed8334f1f7071e081860aac37e83e , < c59738a00aa51b16adc1b5ceb7c80877168efb4d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32",
              "status": "affected",
              "version": "b9e8638e3d9ed8334f1f7071e081860aac37e83e",
              "versionType": "git"
            },
            {
              "lessThan": "00c84f4eec715e501efc080a5670114189e42507",
              "status": "affected",
              "version": "b9e8638e3d9ed8334f1f7071e081860aac37e83e",
              "versionType": "git"
            },
            {
              "lessThan": "2d9846fd1c767920fddd4bde30eb35cd2969df13",
              "status": "affected",
              "version": "b9e8638e3d9ed8334f1f7071e081860aac37e83e",
              "versionType": "git"
            },
            {
              "lessThan": "977e6f006a7a3ffc4216ae6034f768f8de6fd138",
              "status": "affected",
              "version": "b9e8638e3d9ed8334f1f7071e081860aac37e83e",
              "versionType": "git"
            },
            {
              "lessThan": "35f248bd40b47b229d4999581df45b97daadd977",
              "status": "affected",
              "version": "b9e8638e3d9ed8334f1f7071e081860aac37e83e",
              "versionType": "git"
            },
            {
              "lessThan": "311f7d926630940650447cbd1c932b076b40a6c4",
              "status": "affected",
              "version": "b9e8638e3d9ed8334f1f7071e081860aac37e83e",
              "versionType": "git"
            },
            {
              "lessThan": "bf4d338dc8625d70c7f2cb0657d66851a7ac9154",
              "status": "affected",
              "version": "b9e8638e3d9ed8334f1f7071e081860aac37e83e",
              "versionType": "git"
            },
            {
              "lessThan": "c59738a00aa51b16adc1b5ceb7c80877168efb4d",
              "status": "affected",
              "version": "b9e8638e3d9ed8334f1f7071e081860aac37e83e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref\n\nWhen CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return\nsuccess with fh_dentry and fh_export both NULL if fh_verify() returns\nnfserr_stale and putfh-\u003eno_verify is true. The NFSD4_FH_FOREIGN flag\nis set, but the compound dispatch loop only uses this flag to bypass\nthe nfserr_nofilehandle check -- it does not prevent subsequent ops\nfrom running with a NULL fh_dentry.\n\nA remote client can exploit this by crafting a COMPOUND that includes\nan inter-SSC COPY (which causes check_if_stalefh_allowed() to set\nno_verify=true on the saved PUTFH) with an additional op inserted\nbetween the source PUTFH and SAVEFH. For example, SETATTR calls\nfh_want_write() which dereferences fh_export-\u003eex_path.mnt without\ncalling fh_verify() first, causing a NULL pointer dereference in the\nnfsd kthread.\n\nFix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set\nand fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow)\nand ops with ALLOWED_WITHOUT_FH (which don\u0027t need a resolved\nfilehandle) may proceed. All other ops receive nfserr_stale, per\nRFC 7862 Section 15.2.3 which specifies that foreign filehandle\nvalidation is deferred to the consuming operation and NFS4ERR_STALE\nreturned at that point."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in nfsd NFSv4 COMPOUND dispatch and is triggered by a crafted NFSv4.2 COMPOUND over TCP/2049 (PUTFH of a stale fh, then SETATTR, with an inter-SSC COPY in the same compound). No local access is required.\nAC:L - After EXCHANGE_ID/CREATE_SESSION, the attacker fully controls the compound that marks the source PUTFH no_verify and inserts SETATTR before SAVEFH, so fh_want_write hits NULL fh_export deterministically with no race or layout dependency.\nPR:N - AUTH_SYS (the usual nfsd configuration) verifies no secret; a client just asserts a UID to create a session. SETATTR then runs on the FOREIGN fh without fh_verify, so no export access check or other credential gate is reached.\nUI:N - The attacker sends the COMPOUND directly to nfsd; no administrator or victim user action is required at exploitation time.\nS:U - The NULL dereference oopses the nfsd kthread in the host kernel\u0027s own authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - After the stale FOREIGN PUTFH, fh_export and fh_dentry are NULL rather than dangling or attacker-controlled, so the fault is on the first load of fh_export-\u003eex_path.mnt with no disclosure.\nI:N - This is a pure NULL pointer dereference in fh_want_write with no write to attacker-influenced memory and no control-flow hijack primitive.\nA:H - The NULL dereference oopses the nfsd kthread and can be replayed to exhaust nfsd threads, denying NFS service; with panic_on_oops it panics the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:03.192Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32"
        },
        {
          "url": "https://git.kernel.org/stable/c/00c84f4eec715e501efc080a5670114189e42507"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d9846fd1c767920fddd4bde30eb35cd2969df13"
        },
        {
          "url": "https://git.kernel.org/stable/c/977e6f006a7a3ffc4216ae6034f768f8de6fd138"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f248bd40b47b229d4999581df45b97daadd977"
        },
        {
          "url": "https://git.kernel.org/stable/c/311f7d926630940650447cbd1c932b076b40a6c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf4d338dc8625d70c7f2cb0657d66851a7ac9154"
        },
        {
          "url": "https://git.kernel.org/stable/c/c59738a00aa51b16adc1b5ceb7c80877168efb4d"
        }
      ],
      "title": "nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89696",
    "datePublished": "2026-09-11T19:46:15.030Z",
    "dateReserved": "2026-09-11T19:38:34.750Z",
    "dateUpdated": "2026-09-14T12:02:03.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89696",
      "date": "2026-09-16",
      "epss": "0.00762",
      "percentile": "0.53601"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89696\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:56.717\",\"lastModified\":\"2026-09-14T13:19:19.897\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref\\n\\nWhen CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return\\nsuccess with fh_dentry and fh_export both NULL if fh_verify() returns\\nnfserr_stale and putfh-\u003eno_verify is true. The NFSD4_FH_FOREIGN flag\\nis set, but the compound dispatch loop only uses this flag to bypass\\nthe nfserr_nofilehandle check -- it does not prevent subsequent ops\\nfrom running with a NULL fh_dentry.\\n\\nA remote client can exploit this by crafting a COMPOUND that includes\\nan inter-SSC COPY (which causes check_if_stalefh_allowed() to set\\nno_verify=true on the saved PUTFH) with an additional op inserted\\nbetween the source PUTFH and SAVEFH. For example, SETATTR calls\\nfh_want_write() which dereferences fh_export-\u003eex_path.mnt without\\ncalling fh_verify() first, causing a NULL pointer dereference in the\\nnfsd kthread.\\n\\nFix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set\\nand fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow)\\nand ops with ALLOWED_WITHOUT_FH (which don\u0027t need a resolved\\nfilehandle) may proceed. All other ops receive nfserr_stale, per\\nRFC 7862 Section 15.2.3 which specifies that foreign filehandle\\nvalidation is deferred to the consuming operation and NFS4ERR_STALE\\nreturned at that point.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b9e8638e3d9ed8334f1f7071e081860aac37e83e\",\"lessThan\":\"ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9e8638e3d9ed8334f1f7071e081860aac37e83e\",\"lessThan\":\"00c84f4eec715e501efc080a5670114189e42507\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9e8638e3d9ed8334f1f7071e081860aac37e83e\",\"lessThan\":\"2d9846fd1c767920fddd4bde30eb35cd2969df13\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9e8638e3d9ed8334f1f7071e081860aac37e83e\",\"lessThan\":\"977e6f006a7a3ffc4216ae6034f768f8de6fd138\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9e8638e3d9ed8334f1f7071e081860aac37e83e\",\"lessThan\":\"35f248bd40b47b229d4999581df45b97daadd977\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9e8638e3d9ed8334f1f7071e081860aac37e83e\",\"lessThan\":\"311f7d926630940650447cbd1c932b076b40a6c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9e8638e3d9ed8334f1f7071e081860aac37e83e\",\"lessThan\":\"bf4d338dc8625d70c7f2cb0657d66851a7ac9154\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9e8638e3d9ed8334f1f7071e081860aac37e83e\",\"lessThan\":\"c59738a00aa51b16adc1b5ceb7c80877168efb4d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00c84f4eec715e501efc080a5670114189e42507\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2d9846fd1c767920fddd4bde30eb35cd2969df13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/311f7d926630940650447cbd1c932b076b40a6c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/35f248bd40b47b229d4999581df45b97daadd977\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/977e6f006a7a3ffc4216ae6034f768f8de6fd138\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf4d338dc8625d70c7f2cb0657d66851a7ac9154\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c59738a00aa51b16adc1b5ceb7c80877168efb4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ffdc844e673d2bcb2af8c8c3eef8cdea59d0bf32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:52:12+00:00",
      "cve": "CVE-2026-89696",
      "id": "CVE-2026-89696",
      "initial_release_date": "2026-09-11T19:46:15.030000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (nfsd): Denial of Service via crafted NFS COMPOUND requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89696.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:00Z",
      "cve": "CVE-2026-89696",
      "id": "CVE-2026-89696",
      "initial_release_date": "2026-09-12T16:23:33Z",
      "product_status:known_affected": "210",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89696",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89696.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.