CVE-2026-89663

A flaw was found in the Linux kernel's Network File System Daemon (nfsd). This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading to a use-after-free condition. This can cause system instability and potentially allow for unauthorized access.

Red Hat has rated this vulnerability as having an Important severity impact because an authenticated client interacting with NFSv4.2 server-side copy operations can trigger a kernel memory corruption, potentially causing a system crash or privilege escalation. Systems are only exposed if actively hosting NFS shares via the nfs-server service, which is not enabled by default across Red Hat platforms. Environments running Red Hat Enterprise Linux 8 are unaffected as the relevant copy-notify state tracking code is absent.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable the NFS server service or restrict access to trusted networks:

1. If the system does not require NFS server functionality, stop and disable the service:

systemctl stop nfs-server.service
systemctl disable --now nfs-server.service

To prevent the kernel module from being automatically loaded, create a modprobe configuration:

echo "install nfsd /bin/true" > /etc/modprobe.d/disable-nfsd.conf

2. If the NFS server must remain operational, restrict network access to port 2049 using firewalld to ensure only authorized clients can connect:

firewall-cmd --permanent --remove-service=nfs
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>
firewall-cmd --permanent --zone=trusted --add-service=nfs
firewall-cmd --reload

Caveats: Stopping the NFS server or blacklisting nfsd prevents all NFS exports. Applying firewall rules or disabling the service will disconnect active NFS clients and requires a firewall reload or service restart.