CVE-2026-89676

A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. When performing an asynchronous (async) copy operation, a programming error causes a stale identifier (IDR) entry to point to memory that has already been reused. This can lead to memory corruption, where the system attempts to access or free invalid memory. Such an issue could result in system instability or a denial of service (DoS), making the system unavailable to legitimate users.

This vulnerability is rated as Important because an authenticated remote user can trigger kernel memory corruption and potentially cause an operating system crash or privilege escalation over the network. The issue specifically impacts hosts configured to serve NFS shares using the NFSv4.2 protocol with asynchronous server-side copy support. Default installations of Red Hat Enterprise Linux do not run or expose the kernel NFS server daemon, significantly restricting exposure on typical deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If NFS server capabilities are not required on the system, stop and disable the NFS service:

systemctl stop nfs-server.service

systemctl disable nfs-server.service

If the NFS server must remain enabled, restrict access to the NFS port (port 2049) to trusted network interfaces or authorized clients using firewalld:

firewall-cmd --permanent --remove-service=nfs

firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>

firewall-cmd --reload

Caveat: Disabling the nfs-server service prevents all remote clients from mounting and accessing NFS shares hosted on the system. Warning: Stopping the nfs-server service or reloading firewall configurations will disrupt active network connections and terminate ongoing file transfer sessions.