CVE-2026-89679

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or

FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr()

sets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate

the stateid.

If the client supplies the NFSv4 "one stateid" (all-0xFF bytes),

check_special_stateids() returns nfs_ok without populating the output

nfs4_stid pointer, because the special-stateid path in

nfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the

"if (s)" block that would set *cstid is skipped. The local variable `st`

remains NULL.

Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally

dereferences st->sc_type (at offset 4 from NULL), causing a kernel oops.

This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH,

SETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})].

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References