In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a… (CVE-2026-89679)
A null pointer dereference vulnerability in the Linux kernel's NFS server (nfsd) was resolved. The flaw occurs in the nfsd4_setattr function when handling certain delegation timestamp attributes in SETATTR requests. If a client sends a specially crafted NFSv4 SETATTR request with a special 'one stateid' value, the kernel dereferences a null pointer, causing a kernel oops (crash). This can be triggered remotely by any NFSv4 client without authentication or prior state. The fix adds a null check to prevent the dereference.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-89679) in the Linux kernel's nfsd4_setattr function arises when processing SETATTR requests that include delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY). If the client supplies the special NFSv4 'one stateid' (all 0xFF bytes), the function check_special_stateids returns success without setting the expected state pointer. Subsequently, nfsd4_setattr unconditionally dereferences this null pointer, causing a kernel oops. This is remotely triggerable by any NFSv4 client sending a COMPOUND request with PUTROOTFH and SETATTR using the special stateid. The fix involves adding a null pointer check before dereferencing, ensuring the kernel returns an appropriate error instead of crashing.
Potential Impact
The vulnerability can cause a denial of service by crashing the kernel (kernel oops) on an NFS server when processing a crafted NFSv4 SETATTR request. No authentication or prior state is required, so any remote NFSv4 client can trigger this crash. There is no indication of privilege escalation or code execution from the provided data.
Mitigation Recommendations
A fix is available that adds a null pointer check before dereferencing the state pointer in nfsd4_setattr. Users should apply the official Linux kernel patch that addresses CVE-2026-89679. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the patch. Until patched, consider restricting access to the NFS server from untrusted clients to reduce exposure.
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a… (CVE-2026-89679)
Description
A null pointer dereference vulnerability in the Linux kernel's NFS server (nfsd) was resolved. The flaw occurs in the nfsd4_setattr function when handling certain delegation timestamp attributes in SETATTR requests. If a client sends a specially crafted NFSv4 SETATTR request with a special 'one stateid' value, the kernel dereferences a null pointer, causing a kernel oops (crash). This can be triggered remotely by any NFSv4 client without authentication or prior state. The fix adds a null check to prevent the dereference.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-89679) in the Linux kernel's nfsd4_setattr function arises when processing SETATTR requests that include delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY). If the client supplies the special NFSv4 'one stateid' (all 0xFF bytes), the function check_special_stateids returns success without setting the expected state pointer. Subsequently, nfsd4_setattr unconditionally dereferences this null pointer, causing a kernel oops. This is remotely triggerable by any NFSv4 client sending a COMPOUND request with PUTROOTFH and SETATTR using the special stateid. The fix involves adding a null pointer check before dereferencing, ensuring the kernel returns an appropriate error instead of crashing.
Potential Impact
The vulnerability can cause a denial of service by crashing the kernel (kernel oops) on an NFS server when processing a crafted NFSv4 SETATTR request. No authentication or prior state is required, so any remote NFSv4 client can trigger this crash. There is no indication of privilege escalation or code execution from the provided data.
Mitigation Recommendations
A fix is available that adds a null pointer check before dereferencing the state pointer in nfsd4_setattr. Users should apply the official Linux kernel patch that addresses CVE-2026-89679. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the patch. Until patched, consider restricting access to the NFS server from untrusted clients to reduce exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8j83-qm9m-m369
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89679"]
Threat ID: 6aa4a00255bf5e2cf5a86614
Added to database: 09/12/2026, 00:42:42 UTC
Last enriched: 09/12/2026, 00:55:28 UTC
Last updated: 09/12/2026, 00:55:28 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.