CVE-2026-89669 - Vulnerability Details

- nfsd: initialize copy-notify stateid before publishing it

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: initialize copy-notify stateid before publishing it

nfsd4_copy_notify() finished initializing the cpntf state after
nfs4_alloc_init_cpntf_state() had already linked it into the
s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the
membership reference) and none held for the caller. A racing
OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable
so_id) could reach manage_cpntf_state() and free the entry, turning the
caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid
writes into use-after-free. The owning clientid was also only recorded
after publication, so it could not gate an ownership check in that window.

Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()
before nfs4_init_cp_state() publishes the entry, and return it with an
extra reference. The caller reads the stateid under that reference and
drops it with nfs4_put_cpntf_state(); on a late error the laundromat
reaps the entry.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s NFSv4 server contains a race condition in the handling use‑after‑free flaw identified as CWE‑825. The state is initialized after it IDR and parent list; an OFFLOAD_CANCEL request with a crafted client ID and so_id can arrive while the initialization is still in progress, leading to use‑after‑free that corrupts kernel memory. The description does not describe any additional exploitation steps, so the effect is limited to kernel memory corruption or a crash of the NFS server, potentially causing a denial of service.

Affected Systems

All Linux kernel versions that include the NFSv4 server component and have not yet applied the commit changes are potentially affected. The advisory provides no specific release numbers; the vulnerability exists in the code paths referenced by the commit IDs. Systems running an unpatched kernel with the NFSv4 daemon enabled are at risk.

Risk and Exploitability

The CVSS score of 9.8 classifies the issue as critical severity1 % and the vulnerability is not listed in the CISA KEV catalog, indicating that no publicly known exploits have been observed and the likelihood of exploitation is low. The likely attack vector is an attacker with network access to the NFS service who sends a carefully timed OFFLOAD_CANCEL as inferred from the race condition described. If the race corruption or cause the NFS server to crash, disrupting service availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 863b6e995665472f2af5be2436a874ab6a9e5ac6
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< d18d36395d973ef7372c8e6724970585f75b5c0b
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 4415a692346a39fdb647cbd717eda510159aaf55
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 9caad13b7cfe9ccb90cc405ac77335800e086595
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< e08a3dcaca0505f861e344a387f37f94d95dbdc2
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< a4d7fedcaaf33e60a01e53eafca9041ef966212f
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 129643893b79f8a3c6b72045f933fbab5ee424ca

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[624322f1adc58acd0b69f77a6ddc764207e97241,e08a3dcaca0505f861e344a387f37f94d95dbdc2)`	affected	code_commit	—
`[624322f1adc58acd0b69f77a6ddc764207e97241,a4d7fedcaaf33e60a01e53eafca9041ef966212f)`	affected	code_commit	—
`[624322f1adc58acd0b69f77a6ddc764207e97241,4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b)`	affected	code_commit	—
`[624322f1adc58acd0b69f77a6ddc764207e97241,129643893b79f8a3c6b72045f933fbab5ee424ca)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the recent nfsd4_copy_notify and nfs4_alloc_init_cpntf_state commits
If an immediate kernel update is not possible, stop the NFSv4 server daemon, reboot the machine, and restart the NFS service so that no stale state references remain
If the NFSv4 service is not required, disable or remove it from the system configuration to eliminate the attack surface
If disabling is not an option, restrict network access to the NFS service to trusted hosts only to reduce exposure

Generated by OpenCVE AI on September 15, 2026 at 20:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00734.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/129643893b79f8a3c6b72045f933fbab5ee424ca
https://git.kernel.org/stable/c/4415a692346a39fdb647cbd717eda510159aaf55
https://git.kernel.org/stable/c/4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b
https://git.kernel.org/stable/c/863b6e995665472f2af5be2436a874ab6a9e5ac6
https://git.kernel.org/stable/c/9caad13b7cfe9ccb90cc405ac77335800e086595
https://git.kernel.org/stable/c/a4d7fedcaaf33e60a01e53eafca9041ef966212f
https://git.kernel.org/stable/c/d18d36395d973ef7372c8e6724970585f75b5c0b
https://git.kernel.org/stable/c/e08a3dcaca0505f861e344a387f37f94d95dbdc2
https://nvd.nist.gov/vuln/detail/CVE-2026-89669
https://www.cve.org/CVERecord?id=CVE-2026-89669

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4415a692346a39fdb647cbd717eda510159aaf55 https://git.kernel.org/stable/c/863b6e995665472f2af5be2436a874ab6a9e5ac6 https://git.kernel.org/stable/c/9caad13b7cfe9ccb90cc405ac77335800e086595 https://git.kernel.org/stable/c/d18d36395d973ef7372c8e6724970585f75b5c0b

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89669 https://www.cve.org/CVERecord?id=CVE-2026-89669
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state() and free the entry, turning the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window. Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4_put_cpntf_state(); on a late error the laundromat reaps the entry.
Title		nfsd: initialize copy-notify stateid before publishing it
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/129643893b79f8a3c6b72045f933fbab5ee424ca https://git.kernel.org/stable/c/4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b https://git.kernel.org/stable/c/a4d7fedcaaf33e60a01e53eafca9041ef966212f https://git.kernel.org/stable/c/e08a3dcaca0505f861e344a387f37f94d95dbdc2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:55.111Z

Updated: 2026-09-14T12:01:55.666Z

Reserved: 2026-09-11T19:38:34.746Z

Link: CVE-2026-89669

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:53.397

Modified: 2026-09-14T13:19:18.870

Link: CVE-2026-89669

Redhat

Severity : Important

Publid Date: 2026-09-11T19:45:55Z

Links: CVE-2026-89669 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:30:10Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object