CVE-2026-89676

Received Received - Intake

Fix Stale StateID in Linux Kernel NFS Async COPY

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dup_copy_fields() copies only the value into async_copy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cs_type from it and, if the bytes look like an expired NFS4_COPYNOTIFY_STID, follows into refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has the same exposure via idr_find(). Duplicate the fields first, then register the stateid on the stable async_copy. result->cb_stateid is unchanged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89676

EUVD

EUVD-2026-76588

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the NFS server (nfsd) related to async COPY operations. The problem occurs when the s2s_cp_stateids IDR entry is not properly managed, leading to stale stateid references that can be reused by subsequent requests. This can cause memory corruption when the IDR entry is dereferenced later, potentially leading to crashes or arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation and involves a race condition in async COPY operations. Detection requires checking kernel logs for NFS-related errors or crashes, particularly involving stateid handling. No direct commands are provided in the context, but monitoring for kernel panics or NFS server failures may indicate exploitation.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service (DoS) condition by crashing the system or potentially execute arbitrary code with kernel privileges. Systems using NFS with async COPY functionality are at risk, leading to unauthorized access or data corruption.

Compliance Impact

This vulnerability could lead to unauthorized data access or corruption, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected Linux kernels for NFS services may face compliance violations, data breaches, or legal penalties due to potential exposure of sensitive data.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for the nfsd async COPY stateid handling. If immediate patching is not possible, disable NFSv4.2 async COPY functionality as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-89676. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70