CVE-2026-89705 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers using nfsd functionality in their deployments should assess exposure and prioritize verification of affected Linux versions.

Why it matters

A vulnerability in the Linux kernel's nfsd_dispatch() function can cause the rq_status_counter to be left in an odd state, exposing actively mutating fields to a lockless reader. Linux system administrators and security teams should assess exposure and prioritize verification of affected Linux versions.

• Potential data corruption or unauthorized access due to exposure of actively mutating fields
• Possible denial of service (DoS) due to lockless reader treating rqstp fields as stable
• Verification priority for Linux system administrators and security teams to ensure nfsd functionality is properly configured and patched

Technical summary

The Linux kernel's nfsd_dispatch() function sets rq_status_counter to an odd value once a request has been decoded and back to an even value once it has been fully processed. However, not all exit paths restore the counter to even, potentially exposing actively mutating fields to a lockless reader. This can lead to the reader treating the rqstp fields as stable and potentially reading past the end of the 8-element inline ops array. Linux system administrators and security teams should assess exposure and prioritize verification of affected Linux versions, especially those with nfsd functionality in use.

Defensive priority

Linux system administrators and security teams should assess exposure and prioritize verification of affected Linux versions, especially those with nfsd functionality in use.

Recommended defensive actions

• Verify Linux versions and nfsd configuration to determine potential exposure
• Review and apply patches or updates from Linux vendors
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to source code changes. The vulnerability has been resolved in the Linux kernel, and Linux system administrators and security teams should assess exposure and prioritize verification of affected Linux versions. The CVE record was published on 2026-09-11T19:46:21.832Z and has not been modified since then. The source item provides additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.