CVE-2026-89677 Linux CVE debrief

Who should care

Linux system administrators and security teams should assess exposure and apply patches or mitigations as needed. The vulnerability affects Linux kernel deployments, particularly those using the nfsd subsystem. Operators should verify affected versions and apply patches or mitigations to prevent potential use-after-free vulnerabilities.

Why it matters

A vulnerability in the Linux kernel's nfsd subsystem could allow an attacker to compose a filehandle with a wrong dentry, potentially leading to a use-after-free vulnerability. Linux system administrators and security teams should assess exposure and apply patches or mitigations as needed. The corpus does not establish exploitation or impact, and remediation requires verification from the supplied official sources.

• Potential use-after-free vulnerability
• Need to verify affected versions and apply patches
• Monitor for unusual nfsd activity
• Remediation priority is high due to potential impact

Technical summary

The Linux kernel's nfsd subsystem has a vulnerability where dentry_create() can provide a different dentry than expected. This could lead to a use-after-free vulnerability if the dentry stored in resfhp is freed and later dereferenced. The patch moves the fh_compose() call to ensure the final dentry is used, addressing the potential use-after-free vulnerability. The vulnerability has a CVSS score of 9.8, indicating a high severity level. Linux system administrators and security teams should assess exposure and apply patches or mitigations as needed.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from Linux vendors
• Inventory Linux systems for nfsd usage
• Monitor for unusual nfsd activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the corpus does not establish exploitation or impact, and remediation requires verification from the supplied official sources. The official CVE Program record and NIST NVD detail page offer additional information on the vulnerability. Linux system administrators should verify the affected versions and apply patches or mitigations as needed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.