CVE-2026-89664

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release OPEN-decoded posix ACLs via op_release

nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates

refcounted struct posix_acl objects via posix_acl_alloc() and stores

them in open->op_pacl and open->op_dpacl. These pointers must be

released once the OPEN compound finishes.

When nfsd4_decode_open_claim4() returns a non-seqid-mutating error,

the dispatcher short-circuits before op_func runs:

nfsd4_proc_compound()

if (op->status && op->opnum == OP_OPEN)

op->status = nfsd4_open_omfg(...)

if (!seqid_mutating_err(ntohl(op->status)))

return op->status; /* nfsd4_open() never runs */

...

opdesc->op_release(&op->u) /* must still release op_pacl/op_dpacl */

Before this change OP_OPEN had no .op_release in nfsd4_ops[], and the

release pair lived inside nfsd4_open() at its out_err: label. On the

short-circuit path nfsd4_open() is never

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References