CVE-2026-89684

Received Received - Intake

Race Condition in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server. Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89684

EUVD

EUVD-2026-76596

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the NFSv4.2 server's copy offload state management. A published cpntf entry becomes reachable by a client before its list is properly initialized, leading to a use-after-free scenario when a concurrent OFFLOAD_CANCEL operation occurs. The fix ensures the entry is fully linked before becoming visible to clients.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation. Detection requires checking for kernel versions affected by the race condition in nfs4_init_cp_state. Monitor kernel logs for NFS-related crashes or oopses, particularly after OFFLOAD_CANCEL operations. Use commands like 'dmesg | grep nfsd' or 'journalctl -k | grep nfs' to check for errors.

Impact Analysis

This vulnerability could cause a kernel oops or crash on NFSv4.2 servers using copy offload features. Attackers could exploit it to trigger denial-of-service conditions by sending specially crafted requests, potentially disrupting file sharing services.

Mitigation Strategies

Apply the kernel patch that resolves this issue. If immediate patching is not possible, disable NFSv4.2 copy offload features as a temporary workaround. Restrict access to NFS services to trusted networks only. Monitor for signs of exploitation such as unexpected NFS server crashes.

Hi! I’m here to help you understand CVE-2026-89684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70