CVE-2026-89679

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix null dereference in nfsd4 setattr for deleg timestamp attrs

When a SETATTR request includes FATTR4 WORD2 TIME DELEG ACCESS or FATTR4 WORD2 TIME DELEG MODIFY in the attribute bitmap, nfsd4 setattr() sets deleg attrs=true and calls nfs4 preprocess stateid op() to validate the stateid.

If the client supplies the NFSv4 "one stateid" (all-0xFF bytes), check special stateids() returns nfs ok without populating the output nfs4 stid pointer, because the special-stateid path in nfs4 preprocess stateid op() jumps to done: with s==NULL, and the "if (s)" block that would set *cstid is skipped. The local variable st remains NULL.

Back in nfsd4 setattr(), the if (deleg attrs) block then unconditionally dereferences st->sc type (at offset 4 from NULL), causing a kernel oops.

This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH, SETATTR(ONE STATEID, {bmval2=FATTR4 WORD2 TIME DELEG ACCESS, ...})]. No authentication, delegation, or prior state is required.

Fix by adding a NULL check before the dereference. A special stateid is not a delegation stateid, so the existing nfserr bad stateid return value is already correct; we only need to guard the pointer dereference itself.