9.8

CVE-2026-89677

nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

dentry_create() can hypothetically provide a different dentry than the
one passed in.  This could happen, for example, if the exported
filesystem is NFS, and the server returned to OPEN a filehandle which
matched a directory that was already in the dcache.  Clearly this would
not be expected!

If this were to happen the dentry (child) that was already stored in
resfhp could be freed and later dereferenced.

We shouldn't call fh_compose() until we are certain that we have the
final dentry, so this patch moved the fh_compose() call to two places:
one for the case where the target already exists, and one after
dentry_create() where it was created.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 64a989dbd144e0622371396461b11335459692d2
Version < 033e783709ce99662cf81f6abcad746a8da9d35f
Status affected
Version 64a989dbd144e0622371396461b11335459692d2
Version < 3e2c79360c6a89975ec5b5a7d4ef937e4db91a27
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 7.0
Status affected
Version 0
Version < 7.0
Status unaffected
Version <= 7.2.*
Version 7.2.4
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.342
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/033e783709ce99662cf81f6abcad746a8da9d35f
https://git.kernel.org/stable/c/3e2c79360c6a89975ec5b5a7d4ef937e4db91a27