ZDI-CAN-30500: ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability

Published Sep 14, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. Furthermore, only systems with nfsd enabled are vulnerable. The ZDI has assigned a CVSS rating of 8.5. The following CVEs are assigned: CVE-2026-89688.

Affected Software

1 affected component

Linux Kernel

Event History

Sep 14, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Only Linux Kernel systems with the NFS server service (nfsd) enabled are vulnerable. Systems without nfsd enabled are not affected by this issue.

What access does an attacker need to exploit the vulnerability?

The attacker must be able to reach the affected system remotely and must authenticate. The provided information does not indicate that unauthenticated attackers can exploit it.

What is the potential impact of successful exploitation?

A successful attacker can execute arbitrary code on the affected Linux Kernel installation. ZDI assigned the issue a CVSS rating of 8.5.