CVE-2026-89705

A flaw was found in the Linux kernel's Network File System (NFS) daemon, nfsd. This vulnerability occurs due to a synchronization issue where a status counter (rq_status_counter) is not correctly reset on all exit paths within the nfsd_dispatch() function. This can lead to a race condition where a lockless reader accesses actively changing data, potentially reading beyond the intended memory boundary. An attacker could exploit this memory corruption to cause a denial of service or potentially disclose sensitive information.

nfsd_dispatch can leave rq_status_counter in an odd state on cache hit, drop, and encode error exit paths after a request has already been decoded. This breaks the seq-lock style protocol used by nfsd_nl_rpc_status_get_dumpit() and can let the lockless status reader observe actively mutating request fields such as args ops and args opcnt. The risky primitive is an out-of-bounds read past the 8-element inline ops array during compound decode or release. For the CVSS the PR:L is used because a local process must access the nfsd rpc status dump interface, while remote NFS traffic alone is not enough to receive the exposed data. The issue is not directly network reachable as an attacker controlled packet processing bug, but a remote NFS client may help create the server side request states that race with a local status dump reader. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality impact through kernel memory exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.