CVE-2026-89676

What it actually does

Use-after-free in nfsd async COPY handling: nfsd4_copy() registers a stateid IDR entry pointing into a transient per-rqstp COMPOUND buffer; after dup_copy_fields() the IDR still references reused memory so laundromat and manage_cpntf_state() walkers dereference cs_type and perform refcount_dec/idr_remove/kfree on attacker-controlled or garbage data.

Why it matters to the business

Remote attackers can crash or potentially execute arbitrary code on exposed NFS servers, resulting in denial of service, data exfiltration, or full host compromise; the issue affects Red Hat Enterprise Linux 10 kernels and downstream systems that rely on them, though current exploitation likelihood remains low.

How an attack unfolds

An attacker repeatedly issues NFSv4 COMPOUND requests containing async COPY operations; the server registers a stateid against a short-lived buffer, the background copy retains the dangling pointer, and subsequent IDR walkers (laundromat or manage_cpntf_state) are induced to treat the reused memory as a valid NFS4_COPYNOTIFY_STID, triggering use-after-free operations that can be groomed for code execution.

How to fix it

Upgrade the kernel package on Red Hat Enterprise Linux 10 systems to version 6.12.0-211.64.1.el10_2 (RHSA-2026:77690) or later; disable NFSv4 async COPY support if patching cannot be performed immediately.

How to confirm the fix worked

Verify the installed kernel version matches or exceeds the fixed release; confirm nfsd source contains the corrected ordering (dup_copy_fields before nfs4_init_copy_state registration); run regression tests that exercise async COPY followed by stateid cleanup under load.

Typical attack path

1. Establish NFSv4 mount or send unauthenticated COMPOUND requests to the target nfsd
2. Issue COPY operations marked for asynchronous completion to allocate cp_stateid structures
3. Force request buffer reuse by sending additional COMPOUNDs while the background copy is in progress
4. Trigger laundromat or manage_cpntf_state IDR walks that dereference the stale pointer
5. Leverage the resulting use-after-free for memory corruption and privilege escalation

How to detect it

Review nfsd logs and kernel ring buffer for oops or warnings referencing nfs4_copy_state, idr_find, or refcount_dec during COPY operations; correlate with network captures showing high volumes of NFSv4 COMPOUND requests containing COPY.

What your security team should do

• Apply the vendor kernel update within the next maintenance window
• Monitor EPSS and KEV status for any change in exploit maturity
• Restrict NFSv4 access to trusted clients via firewall rules or export options until patched
• Enable kernel memory debugging (KASAN or similar) in test environments to validate the fix