CVE-2026-89696

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1

Description A NULL pointer dereference exists in the nfsd kthread when CONFIG NFSD V4 2 INTER SSC is enabled. This occurs because nfsd4 putfh() can return success with fh dentry and fh export both being NULL if fh verify() returns nfserr stale and putfh->no verify is true. While the NFSD4 FH FOREIGN flag is set, the compound dispatch loop fails to prevent subsequent operations from executing with a NULL fh dentry.

A remote client can trigger this by crafting a COMPOUND request containing an inter-SSC COPY and inserting an additional operation between the source PUTFH and SAVEFH. For instance, a SETATTR operation calls fh want write(), which dereferences fh export->ex path.mnt without prior verification, leading to the crash.

Recommendations Update the Linux kernel to version 7.2.6-1.1 or later.