Linux kernel nfsd: NFSv4 SETATTR with the special ONE stateid NULL-derefs and oopses the server

Impact

A SETATTR carrying FATTR4_WORD2_TIME_DELEG_ACCESS or TIME_DELEG_MODIFY sets deleg_attrs and then dereferences the stateid pointer unconditionally. The NFSv4 all-0xFF "one stateid" validates successfully without populating that pointer, so the server oopses at a NULL offset. The commit message states this is remotely triggerable by any NFSv4 client with a single COMPOUND, with no authentication, delegation or prior state. That makes it the sharpest item in this batch for anyone whose GPU fleet mounts a Linux NFS server: one packet from any host that can open port 2049 halts the file server, and every node holding a mount stalls with it.

Who can reach it

Anyone who can reach the nfsd TCP port and speak NFSv4 - no authentication, no existing state, no delegation required. Exposure is whatever your export and firewall policy allows, which on a storage VLAN is usually every tenant node.

What to do

Update the host kernel to a stable release containing the NULL guard and reboot the NFS server; the fix is in kernel code with no runtime toggle. Until the window opens, restrict reachability of port 2049 to known client subnets - that limits who can send the COMPOUND, it does not remove the bug.

References

Related entries

• Linux kernel nfsd: each failed inter-server COPY leaks an nfsd_file, pinning inode and mountCVE-2026-89680 · Linux kernel nfsd4_copy() (inter-server COPY setup error path)High
• Linux kernel nfsd: race between cpntf publish and OFFLOAD_CANCEL oopses on an uninitialised list headCVE-2026-89684 · Linux kernel nfsd nfs4_alloc_init_cpntf_state() (server-to-server copy stateid IDR)High
• Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitelyCVE-2026-89685 · Linux kernel nfsd clients_still_reclaiming() (grace period deadline)High
• Linux kernel nfsd: file returned by dentry_create() may not actually be open before useCVE-2026-89687 · Linux kernel nfsd_file_do_acquire() (dentry_create / atomic_open result handling)High
• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High