Executive brief
The Linux kernel's NFS server (nfsd) can mishandle file creation requests by attempting to use a file descriptor that was never actually opened. This occurs in rare race conditions when the atomic_open handler bypasses the normal file opening process. An attacker with NFS access could trigger this condition to cause service disruption or potentially read uninitialized file state, affecting systems relying on NFS for file sharing and data access.
Technical details
The vulnerability is a logic error in fs/nfsd/filecache.c where nfsd_file_do_acquire() does not verify that a file returned by dentry_create() was actually opened before using it. The VFS atomic_open handler is permitted to return success via finish_no_open() without actually opening the file, but the nfsd code failed to check the FMODE_OPENED flag before reusing the file descriptor. The attack vector requires network-level access to trigger NFS file creation operations. The fix adds a check for (file->f_mode & FMODE_OPENED) before using the returned file object, ensuring only successfully-opened files are cached and reused.
Affected products
- Linux Linux kernel multiple versions through 6.x
Timeline
- 2026-09-11: disclosed: CVE-2026-89687 published
- 2026-05-26: patched: Fix committed by NeilBrown to kernel stable tree
- 2026-08-03: patched: Commit merged by Chuck Lever