CVE-2026-89663
Description
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading to a use-after-free condition. This can cause system instability and potentially allow for unauthorized access.
Statement
Red Hat has rated this vulnerability as having an Important severity impact because an authenticated client interacting with NFSv4.2 server-side copy operations can trigger a kernel memory corruption, potentially causing a system crash or privilege escalation. Systems are only exposed if actively hosting NFS shares via the nfs-server service, which is not enabled by default across Red Hat platforms. Environments running Red Hat Enterprise Linux 8 are unaffected as the relevant copy-notify state tracking code is absent.
Mitigation
To mitigate this vulnerability, disable the NFS server service or restrict access to trusted networks:
1. If the system does not require NFS server functionality, stop and disable the service:
systemctl stop nfs-server.service
systemctl disable --now nfs-server.service
To prevent the kernel module from being automatically loaded, create a modprobe configuration:
echo "install nfsd /bin/true" > /etc/modprobe.d/disable-nfsd.conf
2. If the NFS server must remain operational, restrict network access to port 2049 using firewalld to ensure only authorized clients can connect:
firewall-cmd --permanent --remove-service=nfs
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>
firewall-cmd --permanent --zone=trusted --add-service=nfs
firewall-cmd --reload
Caveats: Stopping the NFS server or blacklisting nfsd prevents all NFS exports. Applying firewall rules or disabling the service will disconnect active NFS clients and requires a firewall reload or service restart.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 8.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
