CVE-2026-89703
A critical bug in the Linux kernel’s NFS server can cause a use‑after‑free when an administrator revokes a delegation. The flaw occurs because a flag is not set, allowing a freed delegation to be added to a list that is later traversed. This could let an attacker crash the server or potentially execute code.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel NFS server (nfsd) – any system running a kernel that has not yet been patched to include the SC_STATUS_FREED flag in nfsd4_drop_revoked_stid. Typical users are system administrators running NFS services.
Real-world impact
An attacker could crash the NFS server or potentially run arbitrary code on the host, disrupting services or compromising the system.
Why this severity
The CVSS score of 9.8 reflects the high impact (confidentiality, integrity, availability) and the fact that the vulnerability can be exploited remotely with no authentication or user interaction.
What to do about it
- 011. Update the Linux kernel to a version that includes the patch for CVE-2026-89703.
- 022. Reboot the system to load the new kernel.
NVD description indicates the vulnerability has been resolved.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.