Linux kernel nfsd: file returned by dentry_create() may not actually be open before use

Impact

->atomic_open may return success via finish_no_open() without opening the file, so dentry_create() can hand nfsd a file with FMODE_OPENED clear that nfsd then uses anyway. The commit itself calls this extremely unlikely - atomic_open handlers use finish_no_open() for already-existing files, where dentry_create() is not called, and the locked parent should prevent the race - and describes the change as caution rather than a demonstrated exploit. Listed here because NVD scores it 7.5 and it lands on the same NFS server path as the rest of this batch; treat it as low priority next to the remotely triggerable oopses.

Who can reach it

Server-side NFS file-creation path; no demonstrated attacker-controlled trigger is described in the record. Any exposure would be through a filesystem whose atomic_open returns success without opening.

What to do

Picked up with the same stable-kernel update as the other nfsd fixes in this batch - update the host kernel and reboot the NFS server. Not worth its own maintenance window; roll it in with the CVE-2026-89679 patch.

References

Related entries

• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High
• Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way thatCVE-2026-68093 · Linux kernel (arch/x86/kvm/svm)High