CVE-2026-89664 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel security, nfsd administrators, and teams managing Linux-based systems should be aware of this vulnerability and prioritize patching and verifying nfsd configurations.

Why it matters

Defenders should prioritize patching Linux kernel versions affected by this nfsd vulnerability, verify nfsd configurations, and monitor kernel updates to prevent potential reference leaks and exploitation.

• Reference leaks occur on every malformed OPEN compound with valid POSIX ACL createhow4 attributes
• Potential for denial-of-service or privilege escalation if exploited
• Necessity to verify and apply patches to prevent exploitation
• Importance of monitoring Linux kernel updates for security patches

Technical summary

The Linux kernel's nfsd has a vulnerability where nfsd4_decode_createhow4() allocates refcounted struct posix_acl objects and stores them in open->op_pacl and open->op_dpacl. These pointers must be released once the OPEN compound finishes. When nfsd4_decode_open_claim4() returns a non-seqid-mutating error, the dispatcher short-circuits before op_func runs, causing a reference leak on every malformed OPEN compound that carries valid POSIX ACL createhow4 attributes.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those with exposure to nfsd.

Recommended defensive actions

• Verify and apply patches for Linux kernel versions affected by this vulnerability
• Review and update nfsd configurations to prevent exposure to malformed OPEN compounds
• Monitor Linux kernel updates and apply security patches promptly
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to source code changes. Defenders should verify the Linux kernel versions used in their environments and check for any nfsd configurations that may be exposed. The source code changes are available in the official CVE Program record and NIST NVD detail page. Additional information can be found in source references. Evidence is limited to publicly available data and may not reflect the full scope of the The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.