# CVE-2026-89664: nfsd: release OPEN-decoded posix ACLs via op_release

> A memory leak in the Linux kernel NFS server allows attackers to exhaust kernel memory via malformed OPEN compounds, causing denial of service.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 11 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** DEBIAN-CVE-2026-89664, GHSA-2mmp-54r9-hmh2, UBUNTU-CVE-2026-89664

## What is CVE-2026-89664?

CVE-2026-89664 is a high-severity memory corruption vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release OPEN-decoded posix ACLs via op_release

nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates
refcounted struct posix_acl objects via posix_acl_alloc() and stores
them in open->op_pacl and open->op_dpacl. These pointers must be
released once the OPEN compound finishes.

When nfsd4_decode_open_claim4() returns a non-seqid-mutating error,
the dispatcher short-circuits before op_func runs:

    nfsd4_proc_compound()
      if (op->status && op->opnum == OP_OPEN)
          op->status = nfsd4_open_omfg(...)
              if (!seqid_mutating_err(ntohl(op->status)))
                  return op->status;   /* nfsd4_open() never runs */
      ...
      opdesc->op_release(&op->u)  /* must still release op_pacl/op_dpacl */

Before this change OP_OPEN had no .op_release in nfsd4_ops[], and the
release pair lived inside nfsd4_open() at its out_err: label. On the
short-circuit path nfsd4_open() is never invoked, so both posix_acl
refs leak on every malformed OPEN compound that carries valid POSIX
ACL createhow4 attributes.

Add nfsd4_open_release() and wire it as .op_release for OP_OPEN.
posix_acl_release() is NULL-safe, so the single release site covers
both the normal path and the nfsd4_open_omfg short-circuit. Remove
the matching posix_acl_release() pair from nfsd4_open()'s out_err:
label to avoid double-releasing.

The compound loop has two encoding branches: nfsd4_encode_operation()
for normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.
op_release was only called from nfsd4_encode_operation(), so resources
attached to op->u leak on the replay path.

Move the op_release() call out of nfsd4_encode_operation() and the
replay branch, placing it after the if-else in nfsd4_proc_compound().
This gives a single call site in a fairly obviously-correct place,
covering both the normal encoding and replay paths.

## Which versions are affected by CVE-2026-89664?


## How do I fix CVE-2026-89664?

Apply the vendor's patch.

## Is CVE-2026-89664 being exploited?

There is no known exploitation of CVE-2026-89664 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-89664 and fix it if it is affected.

What it is: CVE-2026-89664 is a high-severity memory corruption vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-89664 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-89664/ (Markdown: https://insights.sbomify.com/CVE-2026-89664/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-89664
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89664
- OSV: https://osv.dev/vulnerability/CVE-2026-89664

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-89664/
Summaries are generated and may contain mistakes; the official description above is the record.