Linux kernel nfsd: crafted inter-server COPY compound reaches ops with a NULL filehandle and panics nfsd

Impact

With CONFIG_NFSD_V4_2_INTER_SSC enabled, a PUTFH on a foreign filehandle can succeed with fh_dentry and fh_export both NULL. The dispatch loop only used the FOREIGN flag to skip the nofilehandle check, so a client can insert an op such as SETATTR between the source PUTFH and SAVEFH and dereference NULL in an nfsd kthread. That is a kernel oops on the NFS server, taking the export down for every client on it; on a GPU cluster that is a fleet-wide stall on dataset and checkpoint I/O, and recovery is a reboot of the storage head. Confirm whether your kernel ships CONFIG_NFSD_V4_2_INTER_SSC - servers built without it are not affected.

Who can reach it

A remote NFSv4.2 client that can mount the export and submit a COMPOUND. Normal NFS client authentication is required; no local access to the server is needed.

What to do

Take a kernel with the dispatch gating fix (stable commits 311f7d926630, 35f248bd40b4, bf4d338dc862, c59738a00aa5) and reboot the NFS server. As an interim measure, a kernel built without CONFIG_NFSD_V4_2_INTER_SSC removes the path, but changing that config is itself a rebuild and reboot. Restricting which clients may mount the export narrows exposure but does not fix it.

References

Related entries

• Linux kernel nfsd: unbounded symlink target length lets a client force multi-MiB kmallocs per COMPOUND opCVE-2026-89699 · Linux kernel nfsd (NFSv4 CREATE symlink decoder, cr_datalen)High
• Linux kernel nfsd: async COPY samples the writeback error cursor late and reports failed copies as durableCVE-2026-89704 · Linux kernel nfsd (async server-side COPY, writeback error cursor in _nfsd_copy_file_range)High
• Linux kernel nfsd: write verifier not rotated when async COPY writeback fails, so COMMIT confirms lost dataCVE-2026-89706 · Linux kernel nfsd (async COPY write verifier rotation, nn->writeverf)High
• Linux kernel nfsd: failed cross-mount leaks mount and dentry references on the NFS serverCVE-2026-89707 · Linux kernel nfsd (nfsd_cross_mnt, follow_down() error path refcount leak)High
• Jenkins Script Security Plugin: approved JAR is re-downloaded, letting a second payload load into the controllerCVE-2026-92128 · Jenkins Script Security Plugin (classpath JAR double-download)High
• Jenkins Script Security Plugin: sandbox does not check dynamically added methods, allowing escapeCVE-2026-92129 · Jenkins Script Security Plugin (Groovy sandbox, runtime-added methods)High