Linux Kernel CVE-2026-89705

NFSD must be running and actively processing NFS requests on the target system. The attacker requires a local user account (PR:L) on the NFS server. Access to the NFSD generic netlink family (to invoke nfsd_nl_rpc_status_get_dumpit) is required; this interface is typically accessible to any local user unless restricted via netlink policy. Exploitation requires concurrent operation: one thread triggers a non-success dispatch path (cache-hit, drop, or encode-error), while another reads RPC status via netlink during active NFSv4 compound request processing. The cache-hit path fires naturally whenever the NFSD reply cache is active and a duplicate request arrives, making the trigger condition routine in production. Limiting factors: strictly local (AV:L) - remote unauthenticated attackers cannot exploit this; the bug requires NFSD to be running (not just nfs-utils installed); and a concurrent consumer of the netlink RPC-status interface must be present or initiated by the attacker.

The NVD CVSS 7.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) is broadly consistent with the description. AV:L is correct - exploitation is strictly local; remote unauthenticated paths do not reach this code. AC:L is plausible because once any non-success path fires (cache hits are common in production NFSD with reply cache enabled), the counter stays stuck odd for all subsequent requests, making the exploitation window persistent and wide rather than narrow. PR:L is confirmed by the CVSS vector; no elevated privilege is required beyond a local account able to read the NFSD netlink family. C:H reflects kernel heap memory exposure from OOB reads; A:H reflects the potential kernel panic from reading past the ops array. I:N is correct - no write primitive is exposed. EPSS at 0.19% (9th percentile) and the absence of a CISA KEV listing indicate no known active exploitation. Real-world risk is elevated specifically for NFS servers running 6.7-7.2.3 kernels with RPC-status monitoring tooling (e.g., nfsdclt, nfsstat, systemd-nfsd monitoring) that poll the netlink dumpit interface, since these tools create the concurrent-read condition needed for exploitation. The 6.12 LTS series appears unpatched based on available fix data, extending the exposure window for long-lived stable deployments - this is a notable gap not reflected in the raw CVSS score.

A local low-privileged attacker on an active NFS server triggers an NFSD cache-hit reply (RC_REPLY) for their own NFS request, leaving rq_status_counter stuck odd. The attacker then runs a concurrent loop polling NFSD RPC status via the netlink interface while the server processes NFSv4 compound requests from other clients, causing the lockless reader to consume actively-mutating args->ops and args->opcnt fields and advance reads past the 8-element inline ops array boundary, leaking kernel heap content or panicking the kernel. No public exploit code has been identified at time of analysis.