Memory leak in Linux kernel - CVE-2026-89664
Published: September 12, 2026
Vulnerability identifier: #VU149146
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89664
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory in the NFS server's NFSv4 OPEN operation processing when handling malformed OPEN compounds containing valid POSIX ACL createhow4 attributes. A remote attacker can send a specially crafted malformed NFSv4 OPEN compound to cause a denial of service.
The leaked POSIX ACL references can also occur when processing replayed NFSv4.0 operations.
Affected software
Linux kernel
How to mitigate CVE-2026-89664
Install security update from vendor's repository.