CVE-2026-89664
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via op_release nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates refcounted struct posix_acl objects via posix_acl_alloc() and stores them in open->op_pacl and open->op_dpacl. These pointers must be released once the OPEN compound finishes. When nfsd4_decode_open_claim4() returns a non-seqid-mutating error, the dispatcher short-circuits before op_func runs: nfsd4_proc_compound() if (op->status && op->opnum == OP_OPEN) op->status = nfsd4_open_omfg(...) if (!seqid_mutating_err(ntohl(op->status))) return op->status; /* nfsd4_open() never runs */ ... opdesc->op_release(&op->u) /* must still release op_pacl/op_dpacl */ Before this change OP_OPEN had no .op_release in nfsd4_ops[], and the release pair lived inside nfsd4_open() at its out_err: label. On the short-circuit path nfsd4_open() is never invoked, so both posix_acl refs leak on every malformed OPEN compound that carries valid POSIX ACL createhow4 attributes. Add nfsd4_open_release() and wire it as .op_release for OP_OPEN. posix_acl_release() is NULL-safe, so the single release site covers both the normal path and the nfsd4_open_omfg short-circuit. Remove the matching posix_acl_release() pair from nfsd4_open()'s out_err: label to avoid double-releasing. The compound loop has two encoding branches: nfsd4_encode_operation() for normal ops, and nfsd4_encode_replay() for v4.0 replayed ops. op_release was only called from nfsd4_encode_operation(), so resources attached to op->u leak on the replay path. Move the op_release() call out of nfsd4_encode_operation() and the replay branch, placing it after the if-else in nfsd4_proc_compound(). This gives a single call site in a fairly obviously-correct place, covering both the normal encoding and replay paths.
View original CVE JSON
{
"id": "CVE-2026-89664",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-11T20:19:52.790",
"lastModified": "2026-10-19T09:18:04.383",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release OPEN-decoded posix ACLs via op_release\n\nnfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates\nrefcounted struct posix_acl objects via posix_acl_alloc() and stores\nthem in open->op_pacl and open->op_dpacl. These pointers must be\nreleased once the OPEN compound finishes.\n\nWhen nfsd4_decode_open_claim4() returns a non-seqid-mutating error,\nthe dispatcher short-circuits before op_func runs:\n\n nfsd4_proc_compound()\n if (op->status && op->opnum == OP_OPEN)\n op->status = nfsd4_open_omfg(...)\n if (!seqid_mutating_err(ntohl(op->status)))\n return op->status; /* nfsd4_open() never runs */\n ...\n opdesc->op_release(&op->u) /* must still release op_pacl/op_dpacl */\n\nBefore this change OP_OPEN had no .op_release in nfsd4_ops[], and the\nrelease pair lived inside nfsd4_open() at its out_err: label. On the\nshort-circuit path nfsd4_open() is never invoked, so both posix_acl\nrefs leak on every malformed OPEN compound that carries valid POSIX\nACL createhow4 attributes.\n\nAdd nfsd4_open_release() and wire it as .op_release for OP_OPEN.\nposix_acl_release() is NULL-safe, so the single release site covers\nboth the normal path and the nfsd4_open_omfg short-circuit. Remove\nthe matching posix_acl_release() pair from nfsd4_open()'s out_err:\nlabel to avoid double-releasing.\n\nThe compound loop has two encoding branches: nfsd4_encode_operation()\nfor normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.\nop_release was only called from nfsd4_encode_operation(), so resources\nattached to op->u leak on the replay path.\n\nMove the op_release() call out of nfsd4_encode_operation() and the\nreplay branch, placing it after the if-else in nfsd4_proc_compound().\nThis gives a single call site in a fairly obviously-correct place,\ncovering both the normal encoding and replay paths."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05",
"lessThan": "5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921",
"versionType": "git",
"status": "affected"
},
{
"version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05",
"lessThan": "8215892993ea9f5231da4fa9eb42428a286fce8b",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "7.0",
"status": "affected"
},
{
"version": "0",
"lessThan": "7.0",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.4",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8215892993ea9f5231da4fa9eb42428a286fce8b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}