Cloudanix VulnDB

CVE-2026-89669

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's NFS server code could let a remote attacker take over the entire machine by sending specially timed requests.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Remote Code Execution
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the NFS server copy-notify stateid handling: nfsd4_copy_notify publishes a partially-initialized cpntf stateid entry into the s2s_cp_stateids IDR and sc_cp_list before recording the owning clientid and acquiring an extra reference, allowing a concurrent OFFLOAD_CANCEL to free the object while the caller still holds pointers to it.

Why it matters to the business

Remote attackers can achieve arbitrary code execution or kernel panic on any exposed NFS server, leading to full host compromise, data exfiltration, or denial of service; Red Hat kernels shipping the vulnerable code must be updated before the exposure window widens.

How an attack unfolds

An attacker who can reach the NFS service sends a crafted OFFLOAD_CANCEL using a guessed cl_id matching the server's s2s_cp_cl_id and a guessable so_id; the race window between publication and full initialization lets manage_cpntf_state free the stateid, after which the original caller's subsequent reads and writes become use-after-free.

How to fix it

Upgrade Red Hat Enterprise Linux 10 kernels to 6.12.0-211.64.1.el10_2 or newer and Red Hat Enterprise Linux 9 kernels to 5.14.0-687.56.1.el9_8 or newer (both via RHSA-2026:77689). Reboot after package installation. Until patches are applied, restrict NFS access to trusted clients and disable copy-notify operations if possible via export options.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed packages listed in RHSA-2026:77689; confirm nfsd module no longer contains the vulnerable nfs4_alloc_init_cpntf_state path by inspecting /proc/version or rpm -q kernel; test that COPY_NOTIFY followed by OFFLOAD_CANCEL no longer triggers crashes under load.

Typical attack path

  1. Reachability to an NFSv4 server exporting the copy-notify feature
  2. Guess or observe cl_id and so_id values used for s2s_cp_stateids
  3. Send OFFLOAD_CANCEL concurrently with a legitimate COPY_NOTIFY
  4. Trigger UAF via subsequent stateid dereference in the original caller or laundromat
  5. Leverage freed object for kernel memory corruption or control-flow hijack

How to detect it

Inspect kernel logs (dmesg, /var/log/messages) for use-after-free warnings or slab corruption near nfsd or nfs4_put_cpntf_state; correlate NFSv4 COPY_NOTIFY and OFFLOAD_CANCEL operations from auditd or system-call tracing around the time of any kernel oops or panic; no public exploit artifacts are known.

What your security team should do

  • Apply the referenced Red Hat errata immediately on all exposed systems
  • Prioritize patching internet-facing or high-value NFS servers first
  • Monitor vendor advisories for additional distributions and backports
  • Consider network segmentation or firewall rules limiting NFS traffic until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state() and free the entry, turning the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window. Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4_put_cpntf_state(); on a late error the laundromat reaps the entry.

Affected packages

Ecosystem Package Introduced Fixed