CVE-2026-89694 - Vulnerability Details

- nfsd: check client ownership when cancelling a copy-notify stateid

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check client ownership when cancelling a copy-notify stateid

On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the
target cpntf state without checking ownership. The lookup key
st->si_opaque.so_id is allocated cyclically (guessable) and the embedded
clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated
NFSv4.2 client could cancel and free another client's copy-notify
stateid.

Compare the creating clientid recorded in state->cp_p_clid against the
requesting client's cl_clientid and return nfserr_bad_stateid on a
mismatch instead of freeing the entry.

Published: 2026-09-11

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel NFS daemon, the OFFLOAD_CANCEL routine can free a copy‑notify state without verifying that the requesting client owns the state. This allows an authenticated NFSv4.2 client to cancel another client’s state, causing loss of that client’s transaction state and potential data loss or service disruption. The flaw is an authorization weakness classified as CWE-639.

Affected Systems

All Linux kernel releases that have not yet implemented the ownership check in the nfsd module are vulnerable. Any distribution hosting an NFSv4.2 server on such a kernel is affected, regardless of specific vendor or patch level.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3, indicating medium severity, while the EPSS probability is less than 1 %, showing low current exploitation likelihood. It is not listed in CISA’s KEV catalog. Attackers must authenticate to the NFS server via NFSv4.2 and send OFFLOAD_CANCEL commands, so the vector is the NFS protocol over the network; exposure to untrusted networks increases risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ce0887ac96d35c7105090e166bb0807dc0a0e838`	affected	< 88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9
`ce0887ac96d35c7105090e166bb0807dc0a0e838`	affected	< 81b2cfe767943922eca906a2a5af23a0ce5d0f35
`ce0887ac96d35c7105090e166bb0807dc0a0e838`	affected	< 6bba72b8ee68ad631b94bd439592cba46de54d7d
`ce0887ac96d35c7105090e166bb0807dc0a0e838`	affected	< 75268f6cfe26b09a7e4d3216367e87fe9e2a26aa
`ce0887ac96d35c7105090e166bb0807dc0a0e838`	affected	< b1eca07303594ca27f5dc360a6946bd7e1f5b04c
`ce0887ac96d35c7105090e166bb0807dc0a0e838`	affected	< b42dc26a14b4ad5d6daaada11ec4c70744141c25
`ce0887ac96d35c7105090e166bb0807dc0a0e838`	affected	< d801906165cb5cc250d5cbe44935594e170be3e2
`ce0887ac96d35c7105090e166bb0807dc0a0e838`	affected	< 6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ce0887ac96d35c7105090e166bb0807dc0a0e838,b1eca07303594ca27f5dc360a6946bd7e1f5b04c)`	affected	code_commit	—
`[ce0887ac96d35c7105090e166bb0807dc0a0e838,b42dc26a14b4ad5d6daaada11ec4c70744141c25)`	affected	code_commit	—
`[ce0887ac96d35c7105090e166bb0807dc0a0e838,d801906165cb5cc250d5cbe44935594e170be3e2)`	affected	code_commit	—
`[ce0887ac96d35c7105090e166bb0807dc0a0e838,6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	generic	—
`[6.12.109,7.0.0)`	unaffected	semver	—
`[6.18.50,7.0.0)`	unaffected	semver	—
`[7.2.4,8.0.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the ownership validation fix for the nfsd OFFLOAD_CANCEL path.
If a kernel upgrade is impractical, disable NFSv4.2 support or restrict it to a trusted IP range so that only authorized clients can connect.
Configure firewall rules to limit inbound traffic to the NFS server’s NFS port (2049) to known, trusted hosts.
Enable and monitor NFS audit logging to detect any anomalous OFFLOAD_CANCEL requests that may indicate an attempt to cancel other clients’ states.

Generated by OpenCVE AI on September 15, 2026 at 20:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/6bba72b8ee68ad631b94bd439592cba46de54d7d
https://git.kernel.org/stable/c/6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf
https://git.kernel.org/stable/c/75268f6cfe26b09a7e4d3216367e87fe9e2a26aa
https://git.kernel.org/stable/c/81b2cfe767943922eca906a2a5af23a0ce5d0f35
https://git.kernel.org/stable/c/88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9
https://git.kernel.org/stable/c/b1eca07303594ca27f5dc360a6946bd7e1f5b04c
https://git.kernel.org/stable/c/b42dc26a14b4ad5d6daaada11ec4c70744141c25
https://git.kernel.org/stable/c/d801906165cb5cc250d5cbe44935594e170be3e2
https://nvd.nist.gov/vuln/detail/CVE-2026-89694
https://www.cve.org/CVERecord?id=CVE-2026-89694

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6bba72b8ee68ad631b94bd439592cba46de54d7d https://git.kernel.org/stable/c/75268f6cfe26b09a7e4d3216367e87fe9e2a26aa https://git.kernel.org/stable/c/81b2cfe767943922eca906a2a5af23a0ce5d0f35 https://git.kernel.org/stable/c/88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-639
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89694 https://www.cve.org/CVERecord?id=CVE-2026-89694
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st->si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid. Compare the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.
Title		nfsd: check client ownership when cancelling a copy-notify stateid
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf https://git.kernel.org/stable/c/b1eca07303594ca27f5dc360a6946bd7e1f5b04c https://git.kernel.org/stable/c/b42dc26a14b4ad5d6daaada11ec4c70744141c25 https://git.kernel.org/stable/c/d801906165cb5cc250d5cbe44935594e170be3e2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:13.519Z

Updated: 2026-09-14T12:02:02.130Z

Reserved: 2026-09-11T19:38:34.749Z

Link: CVE-2026-89694

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:56.490

Modified: 2026-09-14T13:19:19.767

Link: CVE-2026-89694

Redhat

Severity : Important

Publid Date: 2026-09-11T19:46:13Z

Links: CVE-2026-89694 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:00:17Z

Weaknesses

CWE-639
Authorization Bypass Through User-Controlled Key

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object