CVE-2026-89669

Received Received - Intake

Use-After-Free in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state() and free the entry, turning the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window. Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4_put_cpntf_state(); on a late error the laundromat reaps the entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-30

NVD

CVE-2026-89669

EUVD

EUVD-2026-76581

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the NFS (Network File System) daemon. The nfsd4_copy_notify function initializes a stateid after it has already been published, creating a race condition. A crafted OFFLOAD_CANCEL request could free the stateid while another process is still using it, leading to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation. Detection requires checking if your system is running a vulnerable kernel version. Use commands like 'uname -a' to check the kernel version and compare it against the patched version. Monitor NFS server logs for unusual activity or crashes that may indicate exploitation attempts.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or execute arbitrary code on a system running a vulnerable Linux kernel with NFS services enabled. It may lead to system crashes, data corruption, or unauthorized access if exploited.

Compliance Impact

This vulnerability involves a use-after-free condition in the Linux kernel's NFS server implementation, specifically in the nfsd4_copy_notify function. While it does not directly relate to data privacy or security controls required by standards like GDPR or HIPAA, it could potentially lead to unauthorized access or data corruption if exploited. Compliance impacts would depend on whether such exploitation results in unauthorized data exposure or integrity breaches.

Mitigation Strategies

Immediately update your Linux kernel to the latest patched version that includes the fix for CVE-2026-89669. If updating is not immediately possible, consider disabling the NFS server service until the patch can be applied to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-89669. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70