GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89688 (GCVE-0-2026-89688)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry In nfs4_preprocess_seqid_op() the stateid is obtained from nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid (sc_count) but takes no reference on the stateowner. openlockstateid() merely casts that stid and likewise takes no reference. When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is being torn down, RP_UNHASHED) it has not taken a stateowner reference on that path. The error handling nevertheless called nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference the function never acquired -- risking a stateowner refcount underflow and use-after-free -- while leaking the sc_count reference held on the stid. The leaked stid reference can also stall a concurrent nfsd4_close_open_stateid() waiting for sc_count to drop. Drop the reference actually held -- the stid -- before retrying. The stateowner stays alive through the reference held by the stid. This mirrors the open path in nfsd4_process_open1(), where the put balances a reference that path explicitly holds on the stateowner.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eec7620800081e27dbf8019ac2e66259f0d5bf6f , < 69ed78b6b947c9257213164678b4edf17533093b (git)
Affected: eec7620800081e27dbf8019ac2e66259f0d5bf6f , < 00843074d9b84824552c9679d423d29500ca5de0 (git)
Affected: eec7620800081e27dbf8019ac2e66259f0d5bf6f , < f7cb90ddc021747fc9abfd4cf5252d425fd34eec (git)
Affected: eec7620800081e27dbf8019ac2e66259f0d5bf6f , < 5e4627d3513e60accfce9d5f4c7fa95251ef93d6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69ed78b6b947c9257213164678b4edf17533093b",
              "status": "affected",
              "version": "eec7620800081e27dbf8019ac2e66259f0d5bf6f",
              "versionType": "git"
            },
            {
              "lessThan": "00843074d9b84824552c9679d423d29500ca5de0",
              "status": "affected",
              "version": "eec7620800081e27dbf8019ac2e66259f0d5bf6f",
              "versionType": "git"
            },
            {
              "lessThan": "f7cb90ddc021747fc9abfd4cf5252d425fd34eec",
              "status": "affected",
              "version": "eec7620800081e27dbf8019ac2e66259f0d5bf6f",
              "versionType": "git"
            },
            {
              "lessThan": "5e4627d3513e60accfce9d5f4c7fa95251ef93d6",
              "status": "affected",
              "version": "eec7620800081e27dbf8019ac2e66259f0d5bf6f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: drop the stateid, not the stateowner, on seqid_op replay retry\n\nIn nfs4_preprocess_seqid_op() the stateid is obtained from\nnfsd4_lookup_stateid(), which holds a reference on the nfs4_stid\n(sc_count) but takes no reference on the stateowner. openlockstateid()\nmerely casts that stid and likewise takes no reference.\n\nWhen nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is\nbeing torn down, RP_UNHASHED) it has not taken a stateowner reference on\nthat path. The error handling nevertheless called\nnfs4_put_stateowner(stp-\u003est_stateowner), dropping an so_count reference\nthe function never acquired -- risking a stateowner refcount underflow and\nuse-after-free -- while leaking the sc_count reference held on the stid.\nThe leaked stid reference can also stall a concurrent\nnfsd4_close_open_stateid() waiting for sc_count to drop.\n\nDrop the reference actually held -- the stid -- before retrying. The\nstateowner stays alive through the reference held by the stid. This mirrors\nthe open path in nfsd4_process_open1(), where the put balances a reference\nthat path explicitly holds on the stateowner."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd processes NFSv4 COMPOUND ops (CLOSE, OPEN_DOWNGRADE, LOCK, OPEN_CONFIRM) in the in-kernel NFS server on TCP/UDP 2049; those handlers call nfs4_preprocess_seqid_op(), so a remote peer reaches the bug with no local access.\nAC:L - A remote NFSv4.0 client drives both sides by sending concurrent CLOSE and another seqid-mutating op on the same openowner; CLOSE\u0027s move_to_close_lru() sets RP_UNHASHED and waits on sc_count, so the window is attacker-controlled and retryable.\nPR:N - Typical nfsd exports use AUTH_SYS/AUTH_NULL, so RPC uids are self-asserted and not cryptographically verified; any host allowed by the export list can SETCLIENTID, OPEN, then CLOSE/OPEN_DOWNGRADE with no local Linux account.\nUI:N - The attacker issues the NFSv4 COMPOUND requests itself; no victim on the server must mount a filesystem, open a file, or take any other action.\nS:U - The underflow frees an nfsd nfs4_stateowner in the NFS server kernel; impact stays in that kernel and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - nfs4_put_stateowner() drops an so_count the seqid path never took, freeing the stateowner while the stid and retry loop still use it; that UAF enables slab reclaim and kernel memory disclosure.\nI:H - The same UAF exposes so_ops-\u003eso_unhash/so_free function pointers and list writes under cl_lock, yielding a kernel write and control-flow hijack primitive.\nA:H - The UAF oopses or panics nfsd; the leaked stid sc_count also leaves move_to_close_lru() waiting forever for sc_count==2, hanging an nfsd thread, and the -EAGAIN retry can spin while RP_UNHASHED stays set."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:12.290Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69ed78b6b947c9257213164678b4edf17533093b"
        },
        {
          "url": "https://git.kernel.org/stable/c/00843074d9b84824552c9679d423d29500ca5de0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7cb90ddc021747fc9abfd4cf5252d425fd34eec"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e4627d3513e60accfce9d5f4c7fa95251ef93d6"
        }
      ],
      "title": "nfsd: drop the stateid, not the stateowner, on seqid_op replay retry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89688",
    "datePublished": "2026-09-11T19:46:09.322Z",
    "dateReserved": "2026-09-11T19:38:34.749Z",
    "dateUpdated": "2026-09-13T06:33:12.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89688",
      "date": "2026-09-15",
      "epss": "0.00608",
      "percentile": "0.47327"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89688\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:55.773\",\"lastModified\":\"2026-09-13T07:17:34.600\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: drop the stateid, not the stateowner, on seqid_op replay retry\\n\\nIn nfs4_preprocess_seqid_op() the stateid is obtained from\\nnfsd4_lookup_stateid(), which holds a reference on the nfs4_stid\\n(sc_count) but takes no reference on the stateowner. openlockstateid()\\nmerely casts that stid and likewise takes no reference.\\n\\nWhen nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is\\nbeing torn down, RP_UNHASHED) it has not taken a stateowner reference on\\nthat path. The error handling nevertheless called\\nnfs4_put_stateowner(stp-\u003est_stateowner), dropping an so_count reference\\nthe function never acquired -- risking a stateowner refcount underflow and\\nuse-after-free -- while leaking the sc_count reference held on the stid.\\nThe leaked stid reference can also stall a concurrent\\nnfsd4_close_open_stateid() waiting for sc_count to drop.\\n\\nDrop the reference actually held -- the stid -- before retrying. The\\nstateowner stays alive through the reference held by the stid. This mirrors\\nthe open path in nfsd4_process_open1(), where the put balances a reference\\nthat path explicitly holds on the stateowner.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eec7620800081e27dbf8019ac2e66259f0d5bf6f\",\"lessThan\":\"69ed78b6b947c9257213164678b4edf17533093b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eec7620800081e27dbf8019ac2e66259f0d5bf6f\",\"lessThan\":\"00843074d9b84824552c9679d423d29500ca5de0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eec7620800081e27dbf8019ac2e66259f0d5bf6f\",\"lessThan\":\"f7cb90ddc021747fc9abfd4cf5252d425fd34eec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eec7620800081e27dbf8019ac2e66259f0d5bf6f\",\"lessThan\":\"5e4627d3513e60accfce9d5f4c7fa95251ef93d6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00843074d9b84824552c9679d423d29500ca5de0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e4627d3513e60accfce9d5f4c7fa95251ef93d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/69ed78b6b947c9257213164678b4edf17533093b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f7cb90ddc021747fc9abfd4cf5252d425fd34eec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T04:38:12+00:00",
      "cve": "CVE-2026-89688",
      "id": "CVE-2026-89688",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "199",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89688.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:13Z",
      "cve": "CVE-2026-89688",
      "id": "CVE-2026-89688",
      "initial_release_date": "2026-09-12T16:23:40Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89688",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89688.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.