CVE-2026-89676

A use-after-free in the Linux kernel's nfsd (NFS server) leaves a stale entry in the s2s_cp_stateids IDR pointing at transient per-request COMPOUND buffer memory whenever an async NFSv4.2 COPY is issued. For the lifetime of the background copy, kernel walkers such as the nfsd laundromat or manage_cpntf_state() dereference this dangling pointer, and if the reused bytes happen to resemble an expired NFS4_COPYNOTIFY_STID they execute refcount_dec(), idr_remove() and kfree() on attacker-influenced garbage, corrupting kernel memory. Because nfsd processes requests over the network and the bug is reachable through the COPY code path, a remote attacker who can reach an NFSv4.2 export can plausibly trigger kernel memory corruption leading to a crash or privilege escalation on the NFS server. The fix reorders the code to duplicate the copy fields onto the stable async_copy structure before registering the stateid. No public proof of concept exists and the flaw is not listed in CISA's KEV, so exploitation is not known to be occurring.

What to do: Patch to a kernel release containing the fix that duplicates copy fields before calling nfs4_init_copy_state(), prioritizing any host running nfsd. Until patched, firewall TCP/2049 and related NFS ports so only trusted client networks can reach the server, and verify exports are not exposed to untrusted segments. Watch for nfsd laundromat panics or oopses referencing s2s_cp_stateids/idr_remove as signs of attempted triggering.