CVE-2026-89684nfsd: fix cpntf publish race in nfs4_init_cp_state
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server. Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 624322f1adc58acd0b69f77a6ddc764207e97241 builds before 63e18fc65587fd3f7b4c6d70e96d32fc41d82ba3; 624322f1adc58acd0b69f77a6ddc764207e97241 builds before 6ac469a274e3c7d87fc46ba46d83b95009680407; 624322f1adc58acd0b69f77a6ddc764207e97241 builds before 8eeca993357a0bc35aaefebfd7462ac7b0a21d9a; from 624322f1adc58acd0b69f77a6ddc764207e97241 before bfeac42d9074e539bacd1898dd8c14b7f5776620; 624322f1adc58acd0b69f77a6ddc764207e97241 builds before 21d6c5957f5ca97d7352e60f55ea412beb9419f5; from 624322f1adc58acd0b69f77a6ddc764207e97241 before a631a26a8777bb235eabd478bbbaf26a4db750bf; from 624322f1adc58acd0b69f77a6ddc764207e97241 before c7270f62e7a05a2ee68aa2b74262b658a14463bd; from 624322f1adc58acd0b69f77a6ddc764207e97241 before be3a5c1d857b0dcbc11796cea603ef25834f75b2 | CNA record |
References
- https://git.kernel.org/stable/c/63e18fc65587fd3f7b4c6d70e96d32fc41d82ba3
- https://git.kernel.org/stable/c/6ac469a274e3c7d87fc46ba46d83b95009680407
- https://git.kernel.org/stable/c/8eeca993357a0bc35aaefebfd7462ac7b0a21d9a
- https://git.kernel.org/stable/c/bfeac42d9074e539bacd1898dd8c14b7f5776620
- https://git.kernel.org/stable/c/21d6c5957f5ca97d7352e60f55ea412beb9419f5
- https://git.kernel.org/stable/c/a631a26a8777bb235eabd478bbbaf26a4db750bf
- https://git.kernel.org/stable/c/c7270f62e7a05a2ee68aa2b74262b658a14463bd
- https://git.kernel.org/stable/c/be3a5c1d857b0dcbc11796cea603ef25834f75b2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.