CVE-2026-89684 - Vulnerability Details

- nfsd: fix cpntf publish race in nfs4_init_cp_state

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix cpntf publish race in nfs4_init_cp_state

nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then
took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap
the entry is reachable by so_id but cp_list is still {NULL,NULL} from
kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as
cnr_stateid, so any NFSv4.2 client can drive it) reaches
manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on
the zeroed list_head, oopsing the server.

Fold the cs_type assignment and the list_add() into the same critical
section as idr_alloc_cyclic(), so a concurrent lookup either misses the
entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after
allocation and switch _free_cpntf_state_locked() to list_del_init() so a
stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and
skips the list_add, preserving NFS4_COPY_STID semantics.

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is a race condition in the Linux NFS server (nfsd) that occurs during the initialization of client notification state. An uninitialized OFFLOAD_CANCEL request from an NFSv4.2 client can cause the kernel to attempt a list_del on a zeroed list_head, producing an oops and crashing the NFS daemon. The resulting kernel panic shuts down the NFS service, exposing all clients to a denial of service. This weakness maps to list handling race conditions (CWE-824).

Affected Systems

The vulnerability affects any Linux kernel that contains the nfs4_init_cp_state path without the latest patch. All distributions running an unpatched kernel are potentially impacted. The fix was introduced in the recent kernel series, so versions prior to that commit remain vulnerable.

Risk and Exploitability

The CVSS score of 7.5 signals high severity, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need access to the NFS service and the ability to issue an OFFLOAD_CANCEL request as an NFSv4.2 client to trigger the race and cause a crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 63e18fc65587fd3f7b4c6d70e96d32fc41d82ba3
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 6ac469a274e3c7d87fc46ba46d83b95009680407
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 8eeca993357a0bc35aaefebfd7462ac7b0a21d9a
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< bfeac42d9074e539bacd1898dd8c14b7f5776620
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< 21d6c5957f5ca97d7352e60f55ea412beb9419f5
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< a631a26a8777bb235eabd478bbbaf26a4db750bf
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< c7270f62e7a05a2ee68aa2b74262b658a14463bd
`624322f1adc58acd0b69f77a6ddc764207e97241`	affected	< be3a5c1d857b0dcbc11796cea603ef25834f75b2

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[624322f1adc58acd0b69f77a6ddc764207e97241,21d6c5957f5ca97d7352e60f55ea412beb9419f5)`	affected	code_commit	—
`[624322f1adc58acd0b69f77a6ddc764207e97241,a631a26a8777bb235eabd478bbbaf26a4db750bf)`	affected	code_commit	—
`[624322f1adc58acd0b69f77a6ddc764207e97241,c7270f62e7a05a2ee68aa2b74262b658a14463bd)`	affected	code_commit	—
`[624322f1adc58acd0b69f77a6ddc764207e97241,be3a5c1d857b0dcbc11796cea603ef25834f75b2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit fixing the nfs4_init_cp_state race.
Restart the NFS service to make the new kernel code active.
If an upgrade cannot be performed immediately, limit NFSv4.2 client access to trusted hosts or disable OFFLOAD_CANCEL handling through NFS configuration to reduce the race window.

Generated by OpenCVE AI on September 15, 2026 at 20:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00716.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/21d6c5957f5ca97d7352e60f55ea412beb9419f5
https://git.kernel.org/stable/c/63e18fc65587fd3f7b4c6d70e96d32fc41d82ba3
https://git.kernel.org/stable/c/6ac469a274e3c7d87fc46ba46d83b95009680407
https://git.kernel.org/stable/c/8eeca993357a0bc35aaefebfd7462ac7b0a21d9a
https://git.kernel.org/stable/c/a631a26a8777bb235eabd478bbbaf26a4db750bf
https://git.kernel.org/stable/c/be3a5c1d857b0dcbc11796cea603ef25834f75b2
https://git.kernel.org/stable/c/bfeac42d9074e539bacd1898dd8c14b7f5776620
https://git.kernel.org/stable/c/c7270f62e7a05a2ee68aa2b74262b658a14463bd
https://nvd.nist.gov/vuln/detail/CVE-2026-89684
https://www.cve.org/CVERecord?id=CVE-2026-89684

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/63e18fc65587fd3f7b4c6d70e96d32fc41d82ba3 https://git.kernel.org/stable/c/6ac469a274e3c7d87fc46ba46d83b95009680407 https://git.kernel.org/stable/c/8eeca993357a0bc35aaefebfd7462ac7b0a21d9a https://git.kernel.org/stable/c/bfeac42d9074e539bacd1898dd8c14b7f5776620

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89684 https://www.cve.org/CVERecord?id=CVE-2026-89684
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server. Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.
Title		nfsd: fix cpntf publish race in nfs4_init_cp_state
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/21d6c5957f5ca97d7352e60f55ea412beb9419f5 https://git.kernel.org/stable/c/a631a26a8777bb235eabd478bbbaf26a4db750bf https://git.kernel.org/stable/c/be3a5c1d857b0dcbc11796cea603ef25834f75b2 https://git.kernel.org/stable/c/c7270f62e7a05a2ee68aa2b74262b658a14463bd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:06.374Z

Updated: 2026-09-14T12:02:01.056Z

Reserved: 2026-09-11T19:38:34.748Z

Link: CVE-2026-89684

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:55.300

Modified: 2026-09-14T13:19:19.610

Link: CVE-2026-89684

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:06Z

Links: CVE-2026-89684 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:30:10Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object