External risk intelligence

Linux kernel NFS delegation revoke race condition.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89686

The vulnerability exists in the Linux kernel NFS (Network File System) implementation. While NFS can be exposed to the network, it is typically deployed within trusted internal networks or segmented environments rather than directly on the public internet, and often requires specific configuration and access to be reachable by external clients.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Linux kernel's NFS component that could allow for system instability if specific conditions are met by concurrent network file operations. This issue has been resolved in the Linux kernel.

NFS file access race condition fixed.
Affects Linux kernel NFS operations.
Confirm relevance and exposure to internal systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by using two NFS clients to trigger a race condition. One client holds a file delegation while another client attempts to open the same file. If the first client does not respond to a recall request, the system revokes the delegation. A subsequent layout request from any client using the delegation's state ID could then hit the vulnerable code path in the Linux kernel's NFS server. This could lead to a system crash.

Entry condition: Network access to NFS server with delegation.
Trigger point: Concurrent delegation recall and layout request.
Resulting risk: Denial of service via kernel crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the behavior of the NFS server, potentially leading to unexpected errors or service interruptions when handling concurrent delegation revocations and file access requests. The core issue involves a race condition within the Linux kernel's NFS server implementation related to file delegations and stateid allocations.

NFS server file state.
Concurrent delegation revocation and access.
Server errors or unexpected behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's NFS implementation likely falls under the responsibility of infrastructure, platform, or core operating system teams. The first practical step is to identify all NFS servers and clients, determine their exposure and criticality, and then coordinate with the relevant system owners to plan remediation.

Identify NFS server/client instances.
Verify NFS usage and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NFS component?

NFS, or Network File System, is a core Linux kernel technology that enables servers to share file directories over a network. It allows client systems to access and mount these remote files as if they were stored locally, facilitating file sharing and data storage across distributed environments.

What kind of vulnerability is CVE-2026-89686?

This vulnerability is a race condition. It occurs when two separate processes or events attempt to interact with the same data simultaneously in an unintended order. In this specific case, the kernel fails to properly synchronize access to file delegation records, which can cause a crash when the system tries to revoke a file access right while another process is requesting it.

How can an attacker trigger this vulnerability?

The flaw requires specific, coordinated activity between multiple NFS clients. An attacker needs to force a delegation recall—usually by having one client hold a file delegation while another requests access—at the exact moment a revocation occurs. This does not happen during standard, single-client file operations; it relies on hitting a narrow timing window where the kernel is processing conflicting state updates.

Is my system at risk of CVE-2026-89686?

Risk depends on whether you run Linux NFS servers that permit delegation, which is a common feature in distributed file environments. According to Halo Surface Signal, this vulnerability is classified as external due to its network-based nature, yet it is often limited to trusted internal segments where NFS is typically deployed. You should evaluate if your NFS services are reachable by unauthorized clients.

What should I do to secure my systems?

The priority is to identify all machines running the Linux kernel as NFS servers. Since this is a kernel-level issue, coordinate with your infrastructure or platform teams to verify if your current kernel versions are affected. Plan for standard system update cycles to apply patches provided by your Linux distribution maintainer, which resolve the locking error and prevent the crash.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.