« Volver al listado

CVE-2026-89679

Estado: RecibidaAlta (7.5)—

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr() sets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate the stateid.

If the client supplies the NFSv4 "one stateid" (all-0xFF bytes), check_special_stateids() returns nfs_ok without populating the output nfs4_stid pointer, because the special-stateid path in nfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the "if (s)" block that would set *cstid is skipped. The local variable `st` remains NULL.

Leer descripción completaMostrar menos

Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally dereferences st->sc_type (at offset 4 from NULL), causing a kernel oops.

This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH, SETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})]. No authentication, delegation, or prior state is required.

Fix by adding a NULL check before the dereference. A special stateid is not a delegation stateid, so the existing nfserr_bad_stateid return value is already correct; we only need to guard the pointer dereference itself.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en NFSv4 remoto sin autenticación: null dereference en nfsd4_setattr() mediante COMPOUND request especial causa kernel oops (DoS). Vector CVSS AV:N/PR:N/UI:N con impacto A:H.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89679",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7e13f4f8d27dc02fb88666f603c53ca749d56f92",
              "lessThan": "3c5119b799a7f57db332b2c31e806de16c869f0f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7e13f4f8d27dc02fb88666f603c53ca749d56f92",
              "lessThan": "3c896db123892256fd39af0ee8c2d02c63539983",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7e13f4f8d27dc02fb88666f603c53ca749d56f92",
              "lessThan": "fe456c8c0931bb3e8a03d429920e87fd85747fba",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:54.660",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3c5119b799a7f57db332b2c31e806de16c869f0f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c896db123892256fd39af0ee8c2d02c63539983",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fe456c8c0931bb3e8a03d429920e87fd85747fba",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs\n\nWhen a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or\nFATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr()\nsets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate\nthe stateid.\n\nIf the client supplies the NFSv4 \"one stateid\" (all-0xFF bytes),\ncheck_special_stateids() returns nfs_ok without populating the output\nnfs4_stid pointer, because the special-stateid path in\nnfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the\n\"if (s)\" block that would set *cstid is skipped. The local variable `st`\nremains NULL.\n\nBack in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally\ndereferences st->sc_type (at offset 4 from NULL), causing a kernel oops.\n\nThis is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH,\nSETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})].\nNo authentication, delegation, or prior state is required.\n\nFix by adding a NULL check before the dereference. A special stateid is\nnot a delegation stateid, so the existing nfserr_bad_stateid return value\nis already correct; we only need to guard the pointer dereference itself."
    }
  ],
  "lastModified": "2026-09-13T07:17:33.647",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}