External risk intelligence

Linux Kernel NFS Delegation Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89703

The vulnerability exists within the Linux kernel's NFS server (nfsd) implementation regarding state ID management for delegations. While NFS can be exposed to a network, it is typically deployed within trusted internal or restricted network segments rather than directly exposed to the public internet, making public exposure uncommon.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in the Linux kernel's NFS server could allow an attacker to potentially compromise system integrity and availability.

A flaw in how the system manages file sharing can be exploited.
Critical flaw impacts system integrity and availability.
Confirm relevance and exposure within your environments.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a use-after-free vulnerability in the Linux kernel's NFS server. This occurs when a state ID for an administrator-revoked delegation is not correctly marked as freed, leading to a situation where the kernel attempts to access memory that has already been deallocated. If an attacker can trigger this specific revocation and state-ID handling scenario, it could result in a crash or potentially more severe code execution.

No authentication or privileges required.
Triggered by revoking delegation.
Leads to a use-after-free vulnerability.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Linux kernel's NFS server could allow an attacker to corrupt client state. This could potentially lead to denial of service or other unintended system behavior when a client's NFS delegations are revoked.

Affected: Client state and NFS service behavior.
Exposure: Via network-connected NFS server.
Consequence: System instability or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's NFS server (nfsd) is the likely area of impact for this vulnerability, suggesting that infrastructure and platform teams responsible for managing Linux systems and their services would be involved. The immediate first step is to locate all instances of the affected NFS server functionality, determine their reachability and criticality to business operations, and identify the system owners. This information will inform the prioritization and planning of remediation efforts.

Infrastructure and platform teams own remediation.
Verify NFS server instances and exposure.
Plan and coordinate system updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel nfsd component affected by CVE-2026-89703?

The Linux kernel nfsd is the software component responsible for the Network File System (NFS) server functionality. It allows Linux systems to share files and directories with other computers over a network. This specific vulnerability involves how the kernel manages state IDs during the process of revoking file delegations, which are essentially temporary permissions granted to clients to cache file access.

How does CVE-2026-89703 cause a use-after-free weakness?

The vulnerability is a memory management flaw. When an administrator revokes a file delegation, the system is supposed to mark the state ID as freed. Because the software fails to set this specific status flag in certain code paths, the kernel may still try to access the memory location where the state ID resided. This 'use-after-free' scenario means the kernel operates on memory that is no longer valid, which can lead to instability.

Do I need to trigger a specific file delegation revocation for this to occur?

Yes. The issue is tied to the internal handling of administrator-revoked NFS delegations. It is not triggered by normal file operations or standard read/write requests. If the system is not actively managing or revoking NFS delegations, this specific path is unlikely to be exercised, though the kernel remains susceptible if such operations are performed.

Is my NFS server at risk based on Halo Surface Signal?

Halo Surface Signal indicates that while the NFS server is network-accessible, it is typically restricted to internal segments, making public exposure uncommon. However, you should check your specific environment to see if any NFS services are reachable from broader, untrusted networks, as that would increase the potential for an attacker to reach the affected service.

When should I prioritize updating systems for this vulnerability?

You should prioritize this by first identifying all Linux systems running the NFS server component. Work with your infrastructure or platform teams to determine which of these systems are critical or reachable from untrusted networks. Once you have an inventory of these instances, you can plan your patching cycle accordingly to apply the necessary kernel updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.