{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89676", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.747Z", "datePublished": "2026-09-11T19:46:00.382Z", "dateUpdated": "2026-09-11T19:46:00.382Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:46:00.382Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result->cb_stateid is unchanged."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4proc.c"], "versions": [{"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a", "status": "affected", "versionType": "git"}, {"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "14b978e8d05ce018d0afbeb6611833ef91713a02", "status": "affected", "versionType": "git"}, {"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "d0beaee498e11880e72826026db0e9c9890fc114", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4proc.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a"}, {"url": "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02"}, {"url": "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"}], "title": "nfsd: fix stale s2s_cp_stateids IDR entry for async COPY", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a", "status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "versionType": "git"}, {"lessThan": "14b978e8d05ce018d0afbeb6611833ef91713a02", "status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "versionType": "git"}, {"lessThan": "d0beaee498e11880e72826026db0e9c9890fc114", "status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result->cb_stateid is unchanged."}], "id": "CVE-2026-89676", "lastModified": "2026-09-11T20:19:54.273", "metrics": {}, "published": "2026-09-11T20:19:54.273", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Memory corruption in nfsd due to stale IDR entry in async COPY", "id": "2532219", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532219"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. When performing an asynchronous (async) copy operation, a programming error causes a stale identifier (IDR) entry to point to memory that has already been reused. This can lead to memory corruption, where the system attempts to access or free invalid memory. Such an issue could result in system instability or a denial of service (DoS), making the system unavailable to legitimate users."], "name": "CVE-2026-89676", "public_date": "2026-09-11T19:46:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89676\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89676\nhttps://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02\nhttps://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a\nhttps://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"], "threat_severity": "Moderate"}

{}