GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89676 (GCVE-0-2026-89676)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:32
VLAI
Title
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dup_copy_fields() copies only the value into async_copy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cs_type from it and, if the bytes look like an expired NFS4_COPYNOTIFY_STID, follows into refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has the same exposure via idr_find(). Duplicate the fields first, then register the stateid on the stable async_copy. result->cb_stateid is unchanged.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 , < 9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a (git)
Affected: e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 , < 14b978e8d05ce018d0afbeb6611833ef91713a02 (git)
Affected: e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 , < d0beaee498e11880e72826026db0e9c9890fc114 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "14b978e8d05ce018d0afbeb6611833ef91713a02",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "d0beaee498e11880e72826026db0e9c9890fc114",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n\u0026u-\u003ecopy-\u003ecp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result-\u003ecb_stateid is unchanged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The dangling s2s_cp_stateids pointer is installed by nfsd4_copy in the in-kernel NFSv4.2 server; a remote client reaches it over TCP/2049 via COMPOUND RPCs (EXCHANGE_ID, CREATE_SESSION, OPEN, then async COPY).\nAC:L - The attacker reliably creates the stale IDR entry with async COPY, then either reuses that nfsd thread\u0027s COMPOUND iops buffer with further requests or sends a \u003e8-op compound so the vcalloc\u0027d ops array is kvfree_rcu\u0027d, and later walks the IDR via OFFLOAD_CANCEL/READ or the laundromat; no condition outside attacker control is required.\nPR:N - Typical nfsd deployments use AUTH_SYS or AUTH_NULL with IP-based exports, so a remote peer that can reach the export can create an NFSv4.2 session, OPEN readable and writable files, and issue async COPY without a local account or capability on the NFS server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export; no victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The stale IDR dereference corrupts kernel nfsd copy and copy-notify state on the NFS server host and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The IDR retains a pointer into reused per-rqstp COMPOUND memory or a kvfree_rcu\u0027d ops array; the laundromat and manage_cpntf_state then read cs_type and adjacent fields from attacker-controlled reused or sprayed memory, a use-after-free disclosure primitive.\nI:H - When reused bytes look like an expired NFS4_COPYNOTIFY_STID, the laundromat and manage_cpntf_state perform list_del, refcount_dec, and kfree on the garbage object, a use-after-free write/free primitive that enables heap corruption and control-flow hijacking.\nA:H - kfree or list_del on the dangling COMPOUND buffer or sprayed slab oopses or panics nfsd worker threads, and the attacker can repeat async COPY plus IDR walks to take down the NFS server host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:58.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"
        }
      ],
      "title": "nfsd: fix stale s2s_cp_stateids IDR entry for async COPY",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89676",
    "datePublished": "2026-09-11T19:46:00.382Z",
    "dateReserved": "2026-09-11T19:38:34.747Z",
    "dateUpdated": "2026-09-13T06:32:58.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89676",
      "date": "2026-09-16",
      "epss": "0.00448",
      "percentile": "0.38091"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89676\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:54.273\",\"lastModified\":\"2026-09-13T07:17:33.310\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\\n\\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\\n\u0026u-\u003ecopy-\u003ecp_stateid -- memory in the per-rqstp COMPOUND buffer that is\\nreused by the next request. dup_copy_fields() copies only the value into\\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\\nbackground copy. Any IDR walker then dereferences reused request memory:\\nthe laundromat reads cs_type from it and, if the bytes look like an\\nexpired NFS4_COPYNOTIFY_STID, follows into\\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\\nthe same exposure via idr_find().\\n\\nDuplicate the fields first, then register the stateid on the stable\\nasync_copy. result-\u003ecb_stateid is unchanged.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e0639dc5805a9d4faaa2c07ad98fa853b9529dd3\",\"lessThan\":\"9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0639dc5805a9d4faaa2c07ad98fa853b9529dd3\",\"lessThan\":\"14b978e8d05ce018d0afbeb6611833ef91713a02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0639dc5805a9d4faaa2c07ad98fa853b9529dd3\",\"lessThan\":\"d0beaee498e11880e72826026db0e9c9890fc114\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T07:00:32+00:00",
      "cve": "CVE-2026-89676",
      "id": "CVE-2026-89676",
      "initial_release_date": "2026-09-11T19:46:00.382000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Memory corruption in nfsd due to stale IDR entry in async COPY",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89676.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:29Z",
      "cve": "CVE-2026-89676",
      "id": "CVE-2026-89676",
      "initial_release_date": "2026-09-12T16:23:53Z",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89676",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89676.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.