CVE-2026-89669

The Linux kernel's NFS server (nfsd) published its copy-notify stateid via nfs4_alloc_init_cpntf_state() before it was fully initialized and without a reference held for the caller. An unauthenticated remote attacker could send a racing OFFLOAD_CANCEL operation with a crafted cl_id and a guessable so_id to trigger manage_cpntf_state() and free the entry, turning the caller's subsequent stateid reads and writes into a use-after-free in kernel memory. Because the owning clientid was only recorded after publication, no ownership check could block the attacker in that window. Any Linux host acting as an NFSv4.2 server with nfsd reachable by the attacker is affected; successful exploitation of the kernel UAF could yield high impact on confidentiality, integrity, and availability (CVSS 9.8), up to and including code execution or a kernel crash. No public PoC exists and the flaw is not in CISA's KEV, so exploitation is presumed limited, but any network client that can reach the NFS service is a potential attacker since no privileges are required.

What to do: Apply your distribution's kernel update once the fix is backported and reboot (or restart nfsd) to load the patched code. Until then, firewall TCP/2049 so only trusted storage clients and backup/clone servers can reach nfsd, and consider disabling NFSv4.2 server-side copy if it is not required. Review NFS server logs and kernel logs for unexpected OFFLOAD_CANCEL/COPY_NOTIFY activity or oopses in nfsd code paths.