Linux nfsd: filehandle composed from a stale dentry when dentry_create returns a different dentry

Impact

nfsd4_create_file() called fh_compose() before it knew which dentry dentry_create() would hand back. If the exported filesystem returns a different dentry than the one passed in - the description gives re-exported NFS returning a filehandle matching a cached directory as the example - the dentry stored in resfhp can be freed and later dereferenced. The exposure is confined to servers re-exporting NFS or a similar filesystem that can substitute a dentry on OPEN; on a plain local export the described condition is hypothetical, and the commit message says so. Where it does apply, the NFS server backing a cluster's shared storage can be crashed by a client OPEN that creates a file.

Who can reach it

An NFSv4 client that can create files on an export, on a server where the underlying filesystem may return a substituted dentry (notably an NFS re-export). Normal client authentication only.

What to do

Update the NFS server kernel to a build containing one of the linked stable commits and reboot the server. Sites that do not re-export NFS or a filesystem with this behaviour can treat it as low priority and pick it up on the next scheduled kernel roll.

References

Related entries

• Linux nfsd: pNFS layout fence worker takes a duplicate reference and leaks the layout stateidCVE-2026-89681 · Linux NFS server (nfsd pNFS layout fence worker, lm_breaker_timedout)Critical
• Linux nfsd: LAYOUTGET racing a delegation revoke hits a BUG_ON and panics the NFS serverCVE-2026-89686 · Linux NFS server (nfsd4_alloc_layout_stateid, fi_deleg_file under fi_lock)Critical
• Linux nfsd: seqid_op replay retry drops a stateowner reference it never tookCVE-2026-89688 · Linux NFS server (nfs4_preprocess_seqid_op, stateowner refcount on replay retry)Critical
• Linux nfsd: session slot shrinker frees the slot in use, corrupting the slab with reply dataCVE-2026-89689 · Linux NFS server (nfsd4_sequence session slot shrinker, free_session_slots)Critical
• Linux nfsd: fh_verify tracepoints size the server address slot wrongly, writing past the trace bufferCVE-2026-89702 · Linux NFS server (nfsd_fh_verify tracepoints, server sockaddr slot sizing)Critical
• Linux nfsd: FREE_STATEID on an admin-revoked delegation leaves it on cl_revoked as freed memoryCVE-2026-89703 · Linux NFS server (nfsd4_drop_revoked_stid, SC_STATUS_FREED on delegations)Critical