CVE-2026-89677

A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When creating files, the dentry_create() function could return an unexpected directory entry (dentry). This could lead to a previously stored dentry being prematurely freed and then used again, potentially causing memory corruption or a denial of service (DoS) due to an invalid memory access.

An NFS server use-after-free can occur in nfsd4_create_file because fh_compose may store a filehandle for a dentry before the final dentry is known. If dentry_create returns a different dentry than the original child, the previously stored child can be freed and later dereferenced through the response filehandle path. A remote NFS client with create or open access to an affected export can potentially trigger this through NFSv4 create/open handling, especially in unusual setups such as NFS re-export where dentry aliasing can occur. For the CVSS the PR:L is used because reliable triggering typically requires valid low privilege access to an exported filesystem with permission to create or open files. The issue is network reachable through nfsd, but AC:H is used because the described condition is hypothetical and depends on specific filesystem and dcache behavior. Impact is at least remote denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact due to the use-after-free class.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.