{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_sendto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fcd91b9957462d398792201c239dffaeff1cc8b2",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "1949dd1576f7a8aa161b1330c6125df9d53046d5",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "0fbe20dfe74b783d255bf389a6ea77aa25dc7860",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b65b18f817d9ada2bf67351f24bdcce6789a0bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d564356e1919d1178568c19af410cfc1a9076663",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.22",
              "versionType": "semver"
            },
            {
              "lessThan": "4.21",
              "status": "affected",
              "version": "4.20.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_sendto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.20.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice\u0027s Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt-\u003esc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client\u0027s\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device\u0027s SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote NFS/RDMA client reaches svc_rdma_sendto over InfiniBand, RoCE, or iWARP, including IP-routable RoCEv2/iWARP and Soft-RoCE, so this is a network attack.\nAC:L - The attacker fully controls omitting the Write list and Reply chunk and the NFS READ size; with the default 4096-byte pull-up buffer and ~5 Send SGEs, a multi-page inline READ deterministically takes the SGE-exhaustion pull-up path and overflows, with no race or uncontrollable layout.\nPR:N - RDMA-CM accept has no credential check, and AUTH_NULL/AUTH_UNIX need no real account; default NFS exports accept those flavors, so a fabric peer can drive a large READ reply without local or init-namespace privileges.\nUI:N - Exploitation requires only attacker-sent RPC-over-RDMA Calls that elicit a large inline reply; no victim mount, click, or other user action is needed beyond nfsd already listening on RDMA.\nS:U - The kmalloc overflow and oversized RDMA Send stay inside the host kernel\u0027s security authority; this is not a VM, IOMMU, or sandbox escape.\nC:H - svc_rdma_xb_linearize() copies past kmalloc sc_xprt_buf, then the inflated sc_sges[0].length is posted with the PD local DMA lkey, so the device reads adjacent kernel memory onto the wire; the heap smash is also leveragable for disclosure.\nI:H - The unbounded memcpy is a heap out-of-bounds write of attacker-influenced NFS READ payload into adjacent slab objects, enabling corruption of neighboring kernel state and control-flow hijacking.\nA:H - Overflowing a 4KB send buffer by up to the NFS/RDMA max payload smashes adjacent slab and can oops or panic, and posting an SGE longer than the DMA mapping can also fault the device or kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:27.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860"
        }
      ],
      "title": "svcrdma: Reject inline replies that overflow the pull-up buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89530",
    "datePublished": "2026-09-11T19:44:10.024Z",
    "dateReserved": "2026-09-11T19:38:34.719Z",
    "dateUpdated": "2026-09-13T06:30:27.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f00e0ab4de45d4f9e4bd0883cf2517acf63fc0d",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "06a62f6dbc60791f4229c6950b1eec6b18df9af1",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "a1fca0f7bbb7b100a39c7ba8dd7922c87c4237a3",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "caddbeffab1eaba1d2bcf5ceda35547863466705",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "6b8149448cdcb476fba4559d1ecc247efee9971b",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "b56d2c5f01cddbeca7d11cce81d97db4ec9a464f",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "ff8a3cff02b92b2a82f1a9876038fcf953ae9c25",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: revoke copy-notify stateids before dropping their reference\n\nCopy-notify stateids live in the s2s_cp_stateids IDR and on their parent\nstid\u0027s sc_cp_list, pinned by a single membership reference.\n_free_cpntf_state_locked() only unlinks an entry once its refcount reaches\nzero, so any revoke path that runs while a concurrent\nfind_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops\nthe reference without unlinking, leaving the entry discoverable with its\nmembership reference already consumed. A second revoke or a laundromat tick\nthen frees it while the reader still holds the pointer -- a\nKASAN-detectable use-after-free at the reader\u0027s nfs4_put_cpntf_state().\n\nThis affected all three revoke paths:\n\n  - The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called\n    _free_cpntf_state_locked() on the first list entry; a holder that had\n    bumped cs_count made it return early, so the next iteration\n    re-decremented and burned the holder\u0027s reference.\n\n  - OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise\n    used _free_cpntf_state_locked() and could drop 2-\u003e1 without unlinking.\n\nAdd revoke_cpntf_state_locked(), which unhashes the entry from the IDR and\nsc_cp_list first (deferring the final free to any holder), and use it from\nall three revoke paths. The drain now walks with list_for_each_entry_safe()\nand revokes each entry unconditionally, so it terminates in one pass per\nentry regardless of cs_count. The unhash is gated on\n!list_empty(\u0026cps-\u003ecp_list); the idr_remove() gate matters because\nidr_alloc_cyclic() may have recycled the so_id by then. Keep\n_free_cpntf_state_locked() for the reference-holder put path only, where a\nconcurrent revoke may already have unlinked the entry (its list_del_init()\nthen a no-op)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the in-kernel NFS server (nfsd); COPY_NOTIFY, READ using a copy-notify stateid, CLOSE, and OFFLOAD_CANCEL are processed from NFSv4.2 compounds over TCP/2049, so a remote NFS client reaches the use-after-free over the network.\nAC:L - A malicious client fully controls both sides of the race: one compound READs with the copy-notify stateid so find_cpntf_state holds a cs_count reference while a concurrent CLOSE or OFFLOAD_CANCEL drains it; nfs4_free_cpntf_statelist then double-decrements and kfree\u0027s the still-linked object with no condition outside attacker control.\nPR:L - The attacker must be an established NFSv4.2 client of an export holding a valid open, lock, or delegation stateid to issue COPY_NOTIFY, which is authenticated low-privilege service access rather than a pre-authentication nfsd path.\nUI:N - No victim action is required; the attacking client drives COPY_NOTIFY, the concurrent READ that holds the cpntf reference, and CLOSE or OFFLOAD_CANCEL on its own NFS connections.\nS:U - The use-after-free corrupts kernel slab memory within the host nfsd security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of struct nfs4_cpntf_state lets a concurrent find_cpntf_state reader dereference a kfree\u0027d object; heap reuse of that slab gives the attacker control over freed contents, enabling arbitrary kernel memory disclosure.\nI:H - After the drain kfree, the holder still writes cpntf_time and later nfs4_put_cpntf_state runs _free_cpntf_state_locked on the freed object, a use-after-free write primitive usable for controlled memory modification and control-flow hijacking.\nA:H - The KASAN-detectable use-after-free at nfs4_put_cpntf_state oopses or panics nfsd worker threads, fully disrupting availability of the NFS server host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:53.477Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f00e0ab4de45d4f9e4bd0883cf2517acf63fc0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a62f6dbc60791f4229c6950b1eec6b18df9af1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1fca0f7bbb7b100a39c7ba8dd7922c87c4237a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/caddbeffab1eaba1d2bcf5ceda35547863466705"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b8149448cdcb476fba4559d1ecc247efee9971b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b56d2c5f01cddbeca7d11cce81d97db4ec9a464f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff8a3cff02b92b2a82f1a9876038fcf953ae9c25"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7"
        }
      ],
      "title": "nfsd: revoke copy-notify stateids before dropping their reference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89663",
    "datePublished": "2026-09-11T19:45:50.577Z",
    "dateReserved": "2026-09-11T19:38:34.744Z",
    "dateUpdated": "2026-09-14T12:01:53.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "863b6e995665472f2af5be2436a874ab6a9e5ac6",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "d18d36395d973ef7372c8e6724970585f75b5c0b",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "4415a692346a39fdb647cbd717eda510159aaf55",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "9caad13b7cfe9ccb90cc405ac77335800e086595",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "e08a3dcaca0505f861e344a387f37f94d95dbdc2",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "a4d7fedcaaf33e60a01e53eafca9041ef966212f",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "129643893b79f8a3c6b72045f933fbab5ee424ca",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialize copy-notify stateid before publishing it\n\nnfsd4_copy_notify() finished initializing the cpntf state after\nnfs4_alloc_init_cpntf_state() had already linked it into the\ns2s_cp_stateids IDR and the parent\u0027s sc_cp_list, with cs_count == 1 (the\nmembership reference) and none held for the caller. A racing\nOFFLOAD_CANCEL (crafted cl_id == nn-\u003es2s_cp_cl_id plus the guessable\nso_id) could reach manage_cpntf_state() and free the entry, turning the\ncaller\u0027s subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid\nwrites into use-after-free. The owning clientid was also only recorded\nafter publication, so it could not gate an ownership check in that window.\n\nRecord cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()\nbefore nfs4_init_cp_state() publishes the entry, and return it with an\nextra reference. The caller reads the stateid under that reference and\ndrops it with nfs4_put_cpntf_state(); on a late error the laundromat\nreaps the entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is in nfsd COPY_NOTIFY (nfsd4_copy_notify/nfs4_alloc_init_cpntf_state). NFSv4.2 COPY_NOTIFY and a racing OFFLOAD_CANCEL are processed from compounds over TCP/2049 via nfsd4_proc_compound, so a remote NFS client reaches the published cpntf object over the network.\nAC:L - The attacker controls both sides: one compound publishes the cpntf IDR entry via COPY_NOTIFY while a concurrent OFFLOAD_CANCEL uses the leaked nn-\u003es2s_cp_cl_id and a cyclic guessable so_id to kfree it before initialization finishes; the race is retryable on multiple session slots with no condition outside attacker control.\nPR:N - Default AUTH_SYS/AUTH_NULL nfsd exports do no cryptographic authentication; any host allowed by the export ACL can EXCHANGE_ID/CREATE_SESSION, OPEN a readable file, and issue COPY_NOTIFY and OFFLOAD_CANCEL. No local account or capability on the NFS server is required.\nUI:N - The attacking NFS client drives COPY_NOTIFY and the concurrent OFFLOAD_CANCEL on its own connections; no victim user or administrator action on the NFS server is required at attack time.\nS:U - The use-after-free corrupts a kmalloc\u0027d nfs4_cpntf_state in the host kernel\u0027s nfsd copy-notify tables. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After OFFLOAD_CANCEL kfree\u0027s the object (cs_count was 1), nfsd4_copy_notify memcpy\u0027s the freed cp_stateid.cs_stid into the RPC reply; reclaim of that kmalloc slab lets the attacker disclose kernel memory. Per kernel guidance a use-after-free is C:H.\nI:H - The same path then writes cp_p_stateid and cp_p_clid into the freed nfs4_cpntf_state, a use-after-free write primitive usable for heap corruption and control-flow hijacking. Per kernel guidance a use-after-free is I:H.\nA:H - Use-after-free of nfs4_cpntf_state in an nfsd worker oopses or panics the NFS server even without full exploitation, and the attacker can repeat the concurrent RPC sequence to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:55.666Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/863b6e995665472f2af5be2436a874ab6a9e5ac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d18d36395d973ef7372c8e6724970585f75b5c0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4415a692346a39fdb647cbd717eda510159aaf55"
        },
        {
          "url": "https://git.kernel.org/stable/c/9caad13b7cfe9ccb90cc405ac77335800e086595"
        },
        {
          "url": "https://git.kernel.org/stable/c/e08a3dcaca0505f861e344a387f37f94d95dbdc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4d7fedcaaf33e60a01e53eafca9041ef966212f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b"
        },
        {
          "url": "https://git.kernel.org/stable/c/129643893b79f8a3c6b72045f933fbab5ee424ca"
        }
      ],
      "title": "nfsd: initialize copy-notify stateid before publishing it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89669",
    "datePublished": "2026-09-11T19:45:55.111Z",
    "dateReserved": "2026-09-11T19:38:34.746Z",
    "dateUpdated": "2026-09-14T12:01:55.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9031493ef7369d5c59c4bacc96f0c85965f09a98",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "a385cf5e016b748babf94cc664e43a26e17db117",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "62c0f6eaf050bb9284c1f9cac6ed1770092e6b95",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix UAF in async copy cancel and shutdown\n\nAn async copy could be freed or used after free while a teardown caller\n(OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the\ncopy kthread:\n\n  - find_async_copy() bumped copy-\u003erefcount but left the copy on\n    clp-\u003easync_copies, so the reaper\u0027s cleanup_async_copy() could run\n    release_copy_files() concurrently with a cancel/shutdown caller. Both\n    put and NULL nf_src/nf_dst without a common lock, double-putting the\n    nfsd_file and freeing it early.\n\n  - nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses\n    of the copy (nfsd_update_cmtime_attr() on copy-\u003enf_dst,\n    nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit\n    as \"kthread done, skip kthread_stop()\", so a teardown caller ran\n    release_copy_files() -- which puts and NULLs nf_dst -- while the\n    kthread still dereferenced it (NULL/UAF).\n\n  - copy-\u003ecopy_task was never pinned. The one-shot kthread self-reaps on\n    return, so kthread_stop()\u0027s get_task_struct() could touch a freed\n    task_struct.\n\n  - co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a\n    reference only on the client, so a concurrent teardown could free\n    the copy while the CB_OFFLOAD callback was in flight.\n\nFix the teardown lifetime as a whole:\n\n  - find_async_copy() unlinks the copy (clear cp_clp, list_del_init)\n    under async_lock; the cancel, shutdown, and sb-cancel paths drop the\n    list-membership reference via nfs4_put_copy() after nfsd4_stop_copy().\n    Drop the now-redundant list_del fixup from cleanup_async_copy().\n\n  - Because unlinking hides the copy from the reaper, its\n    cleanup_async_copy() can no longer remove the copy\u0027s s2s_cp_stateids\n    entry; the cancel/shutdown/sb-cancel paths now call\n    nfs4_free_copy_state() themselves (while cp_clp is still valid) so\n    the entry does not dangle at freed memory for the laundromat and\n    manage_cpntf_state() to dereference.\n\n  - Give the kthread its own reference, taken in nfsd4_copy() before\n    wake_up_process() and dropped at the end of nfsd4_do_async_copy();\n    call wake_up_process() before list_add().\n\n  - Pin the task_struct with get_task_struct() in nfsd4_copy(), released\n    in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread\n    exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now\n    always kthread_stop()s before release_copy_files(); completion is\n    still reported via NFSD4_COPY_F_COMPLETED, so\n    nfsd4_has_active_async_copies() is unaffected. Each teardown caller\n    removes the copy from clp-\u003easync_copies first, so kthread_stop() runs\n    exactly once.\n\n  - Take a copy reference in nfsd4_send_cb_offload(), dropped in\n    nfsd4_cb_offload_release(). The kthread still holds its own reference\n    there, so the refcount_inc() cannot race the final free.\n\n  - Read cp_clp with smp_load_acquire() to pair with the unordered\n    set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nfsd\u0027s NFSv4.2 OP_COPY and OP_OFFLOAD_CANCEL handlers (nfsd4_copy/nfsd4_offload_cancel in fs/nfsd/nfs4proc.c), reached by sending COMPOUND RPCs over TCP port 2049 to the in-kernel NFS server; no local access to the host is required.\nAC:L - The attacker controls both sides of the race by starting an async COPY then issuing OFFLOAD_CANCEL or DESTROY_CLIENTID, and can stall CB_OFFLOAD replies so the embedded callback stays in flight on freed memory; the window is retryable and does not depend on uninfluenced victim state.\nPR:N - Under AUTH_SYS, the default NFS configuration, the server verifies no secret; EXCHANGE_ID, CREATE_SESSION, and OPEN succeed for any host permitted by the export, so a remote NFSv4.2 client needs no kernel-verified credentials or local privileges on the server.\nUI:N - The attacker\u0027s own NFS client issues COPY and OFFLOAD_CANCEL (or DESTROY_CLIENTID) against an already-running nfsd export; no administrator or other user action on the server is required.\nS:U - Impact is kernel heap use-after-free and nfsd state corruption within the same host kernel security authority; it does not cross a VM, hypervisor, or IOMMU boundary.\nC:H - Use-after-free of the nfsd4_copy object (including its embedded nfsd4_callback), nfsd_file src/dst objects, and the copy kthread task_struct allows slab reuse that can be leveraged for arbitrary kernel memory reads.\nI:H - The same UAFs enable heap spraying and arbitrary writes; CB_OFFLOAD work and rpc_task callbacks invoke cb_ops function pointers that live inside the freed copy, supporting control-flow hijack.\nA:H - Concurrent release_copy_files() double-puts nfsd_file, kthread_stop() can touch a self-reaped task_struct, and the copy kthread can NULL-dereference nf_dst after teardown, each of which oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:57.451Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9031493ef7369d5c59c4bacc96f0c85965f09a98"
        },
        {
          "url": "https://git.kernel.org/stable/c/a385cf5e016b748babf94cc664e43a26e17db117"
        },
        {
          "url": "https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95"
        }
      ],
      "title": "nfsd: fix UAF in async copy cancel and shutdown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89675",
    "datePublished": "2026-09-11T19:45:59.635Z",
    "dateReserved": "2026-09-11T19:38:34.747Z",
    "dateUpdated": "2026-09-13T06:32:57.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7aa34ea78f74e6ef60c8112635a87fc43d57f6c9",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "14b978e8d05ce018d0afbeb6611833ef91713a02",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "d0beaee498e11880e72826026db0e9c9890fc114",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n\u0026u-\u003ecopy-\u003ecp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result-\u003ecb_stateid is unchanged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The dangling s2s_cp_stateids pointer is installed by nfsd4_copy in the in-kernel NFSv4.2 server; a remote client reaches it over TCP/2049 via COMPOUND RPCs (EXCHANGE_ID, CREATE_SESSION, OPEN, then async COPY).\nAC:L - The attacker reliably creates the stale IDR entry with async COPY, then either reuses that nfsd thread\u0027s COMPOUND iops buffer with further requests or sends a \u003e8-op compound so the vcalloc\u0027d ops array is kvfree_rcu\u0027d, and later walks the IDR via OFFLOAD_CANCEL/READ or the laundromat; no condition outside attacker control is required.\nPR:N - Typical nfsd deployments use AUTH_SYS or AUTH_NULL with IP-based exports, so a remote peer that can reach the export can create an NFSv4.2 session, OPEN readable and writable files, and issue async COPY without a local account or capability on the NFS server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export; no victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The stale IDR dereference corrupts kernel nfsd copy and copy-notify state on the NFS server host and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The IDR retains a pointer into reused per-rqstp COMPOUND memory or a kvfree_rcu\u0027d ops array; the laundromat and manage_cpntf_state then read cs_type and adjacent fields from attacker-controlled reused or sprayed memory, a use-after-free disclosure primitive.\nI:H - When reused bytes look like an expired NFS4_COPYNOTIFY_STID, the laundromat and manage_cpntf_state perform list_del, refcount_dec, and kfree on the garbage object, a use-after-free write/free primitive that enables heap corruption and control-flow hijacking.\nA:H - kfree or list_del on the dangling COMPOUND buffer or sprayed slab oopses or panics nfsd worker threads, and the attacker can repeat async COPY plus IDR walks to take down the NFS server host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:14:43.984Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"
        }
      ],
      "title": "nfsd: fix stale s2s_cp_stateids IDR entry for async COPY",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89676",
    "datePublished": "2026-09-11T19:46:00.382Z",
    "dateReserved": "2026-09-11T19:38:34.747Z",
    "dateUpdated": "2026-09-21T13:14:43.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48f72aff24f7a7329209dc6cbc27c869f3e3595c",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "6703199f4d7e7f37d6a726a849eb358e8fae72fb",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "19413ccc45070a7270b9e25c2a258daf7f91de42",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "fca26a3fc19ed02278aa2a150af82d43db0302cb",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: defer vfree of compound ops to fix rpc_status UAF\n\nThe rpc_status netlink dumpit walks every in-flight svc_rqst under\nrcu_read_lock and, for NFSv4 requests, reads opnums out of\nargs-\u003eops[]. But args-\u003eops is a separate vmalloc buffer freed\nsynchronously by vfree() in nfsd4_release_compoundargs() at the end\nof every compound. The dumpit\u0027s rcu_read_lock pins the svc_rqst\nstruct itself (freed via kfree_rcu), but nothing defers the vfree\nof the ops buffer across the RCU grace period. A concurrent compound\ncompletion can therefore free the buffer while the dumpit is reading\nit \u2014 a use-after-free on vmalloc memory.\n\nThe trailing seqcount recheck (smp_load_acquire of rq_status_counter)\ncannot undo a load that already retired against freed memory.\n\nFix by replacing vfree(args-\u003eops) with kvfree_rcu_mightsleep(), which\ndefers the free until after an RCU grace period. This makes the\nexisting rcu_read_lock in the dumpit sufficient to protect the read.\nThe tradeoff is that completed compound ops buffers (up to\n200 * sizeof(struct nfsd4_op)) persist in memory slightly longer,\nacross one grace period, before being reclaimed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in nfsd_nl_rpc_status_get_dumpit(), reached only via the NFSD_CMD_RPC_STATUS_GET generic-netlink dump over AF_NETLINK. Remote NFSv4 compounds drive the vfree of args-\u003eops in nfsd4_release_compoundargs() but never enter dumpit, so exploitation requires local access.\nAC:L - The attacker fully controls the dumpit reader and can loop it while sending NFSv4 COMPOUNDs with more than eight ops so nfsd vcalloc()s args-\u003eops and vfree()s it on every request. That is an attacker-driven race; the seqcount recheck does not prevent the already-retired load against freed vmalloc memory.\nPR:L - NFSD_CMD_RPC_STATUS_GET is registered with GENL_CMD_CAP_DUMP and no GENL_ADMIN_PERM, so any unprivileged process in the nfsd network namespace can invoke the dump. Exploitation does not require CAP_NET_ADMIN or root.\nUI:N - The attacker issues the netlink dump themselves and can generate the concurrent NFSv4 compounds; no separate victim action such as mounting a filesystem or opening a device is required.\nS:U - This is a kernel vmalloc use-after-free in nfsd on the local host. Impact stays inside the kernel\u0027s security authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - dumpit reads opnums from the vfree\u0027d args-\u003eops[] buffer and returns them to userspace via NFSD_A_RPC_STATUS_COMPOUND_OPS. A kernel UAF with reuse of that vmalloc region yields an arbitrary-read primitive, which CVSS treats as high confidentiality impact.\nI:H - This is a use-after-free of a vmalloc compound-ops array that dumpit walks under rcu_read_lock while nfsd vfree()s it. UAF of attacker-reclaimable kernel memory enables corruption and control-flow hijacking primitives, not crash-only impact.\nA:H - Use-after-free of a vfree\u0027d vmalloc buffer while dumpit still loads args-\u003eops[j].opnum oopses or panics the kernel even if the UAF is not turned into code execution, fully disrupting the NFS server host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:14.771Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48f72aff24f7a7329209dc6cbc27c869f3e3595c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6703199f4d7e7f37d6a726a849eb358e8fae72fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/19413ccc45070a7270b9e25c2a258daf7f91de42"
        },
        {
          "url": "https://git.kernel.org/stable/c/fca26a3fc19ed02278aa2a150af82d43db0302cb"
        }
      ],
      "title": "nfsd: defer vfree of compound ops to fix rpc_status UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89690",
    "datePublished": "2026-09-11T19:46:10.632Z",
    "dateReserved": "2026-09-11T19:38:34.749Z",
    "dateUpdated": "2026-09-13T06:33:14.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}