Linux kernel nfsd: file returned by dentry_create() may not actually be open before use

Impact

->atomic_open may return success via finish_no_open() without opening the file, so dentry_create() can hand nfsd a file with FMODE_OPENED clear that nfsd then uses anyway. The commit itself calls this extremely unlikely - atomic_open handlers use finish_no_open() for already-existing files, where dentry_create() is not called, and the locked parent should prevent the race - and describes the change as caution rather than a demonstrated exploit. Listed here because NVD scores it 7.5 and it lands on the same NFS server path as the rest of this batch; treat it as low priority next to the remotely triggerable oopses.

Who can reach it

Server-side NFS file-creation path; no demonstrated attacker-controlled trigger is described in the record. Any exposure would be through a filesystem whose atomic_open returns success without opening.

What to do

Picked up with the same stable-kernel update as the other nfsd fixes in this batch - update the host kernel and reboot the NFS server. Not worth its own maintenance window; roll it in with the CVE-2026-89679 patch.

References

Related entries

• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High
• Linux nvmet-tcp: unsolicited H2CData PDU double-completes a command and wedges the targetCVE-2026-89968 · Linux kernel nvmet-tcp (NVMe-oF TCP target)High
• Linux NVMe host: a positive Identify status is ignored and a zoned queue is set up with zero zone sizeCVE-2026-89971 · Linux kernel NVMe host (zoned namespace limits update)High
• Linux nvme-fc: double free of fabrics options when nvme_add_ctrl() fails during connectCVE-2026-89974 · Linux kernel nvme-fc (fabrics options ownership on controller init failure)High
• Linux kernel NFSv4 client: dropped delegations leave the state manager looping on revoked stateCVE-2026-90234 · Linux kernel NFSv4 client (delegation handling in nfs_inode_set_delegation)High
• Linux qla2xxx: dying NPIV vport re-inserted into host_map during report ID acquisition, causing use-after-freeCVE-2026-97531 · Linux kernel scsi/qla2xxx (report ID acquisition vs. vport deletion)High