Linux kernel nfsd: crafted inter-server COPY compound reaches ops with a NULL filehandle and panics nfsd

Impact

With CONFIG_NFSD_V4_2_INTER_SSC enabled, a PUTFH on a foreign filehandle can succeed with fh_dentry and fh_export both NULL. The dispatch loop only used the FOREIGN flag to skip the nofilehandle check, so a client can insert an op such as SETATTR between the source PUTFH and SAVEFH and dereference NULL in an nfsd kthread. That is a kernel oops on the NFS server, taking the export down for every client on it; on a GPU cluster that is a fleet-wide stall on dataset and checkpoint I/O, and recovery is a reboot of the storage head. Confirm whether your kernel ships CONFIG_NFSD_V4_2_INTER_SSC - servers built without it are not affected.

Who can reach it

A remote NFSv4.2 client that can mount the export and submit a COMPOUND. Normal NFS client authentication is required; no local access to the server is needed.

What to do

Take a kernel with the dispatch gating fix (stable commits 311f7d926630, 35f248bd40b4, bf4d338dc862, c59738a00aa5) and reboot the NFS server. As an interim measure, a kernel built without CONFIG_NFSD_V4_2_INTER_SSC removes the path, but changing that config is itself a rebuild and reboot. Restricting which clients may mount the export narrows exposure but does not fix it.

References

Related entries

• Linux kernel nfsd: unbounded symlink target length lets a client force multi-MiB kmallocs per COMPOUND opCVE-2026-89699 · Linux kernel nfsd (NFSv4 CREATE symlink decoder, cr_datalen)High
• Linux kernel nfsd: async COPY samples the writeback error cursor late and reports failed copies as durableCVE-2026-89704 · Linux kernel nfsd (async server-side COPY, writeback error cursor in _nfsd_copy_file_range)High
• Linux kernel nfsd: write verifier not rotated when async COPY writeback fails, so COMMIT confirms lost dataCVE-2026-89706 · Linux kernel nfsd (async COPY write verifier rotation, nn->writeverf)High
• Linux kernel nfsd: failed cross-mount leaks mount and dentry references on the NFS serverCVE-2026-89707 · Linux kernel nfsd (nfsd_cross_mnt, follow_down() error path refcount leak)High
• ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worseCVE-2020-13817 · ntpd (transmit timestamp prediction)High
• Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN): A device plugged into a normal front-panel port can talk itsCVE-2021-1228 · Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN)High