Cloudanix VulnDB

CVE-2026-89694

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux file sharing allowed one connected client to interfere with another client's file copy operations, which could interrupt shared storage workflows until servers are updated.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
OS kernel
Class
Authorization Bypass
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Authorization bypass in NFSd allowing any authenticated NFSv4.2 client to cancel and free copy-notify stateids owned by other clients due to missing ownership verification on the OFFLOAD_CANCEL path using a cyclically allocated guessable lookup key.

Why it matters to the business

Disruption of ongoing NFS copy operations across clients in shared storage environments, potentially causing data transfer failures or incomplete offloads without requiring elevated privileges beyond basic NFS authentication.

How an attack unfolds

An authenticated NFSv4.2 client sends a crafted OFFLOAD_CANCEL request using a predictable stateid opaque ID and the fixed per-net client ID; the kernel frees the target state without comparing the recorded creating client ID against the requester, allowing cross-client interference.

How to fix it

Apply the upstream kernel patch that adds client ID ownership verification in manage_cpntf_state() before freeing entries on the OFFLOAD_CANCEL path; rebuild and deploy the fixed kernel across all affected NFS servers.

How to confirm the fix worked

Inspect the nfsd source for the added cp_p_clid comparison and nfserr_bad_stateid return on mismatch; confirm via kernel version or changelog entry referencing the state ownership check.

Typical attack path

  1. Authenticate as a valid NFSv4.2 client to the target server
  2. Observe or guess a valid copy-notify stateid opaque ID from the cyclic allocator
  3. Issue OFFLOAD_CANCEL request referencing another client's state
  4. Trigger premature freeing of the victim's copy-notify stateid

How to detect it

Review NFS server logs for OFFLOAD_CANCEL requests that result in stateid operations without corresponding prior COPY_NOTIFY from the same client; correlate with stateid opaque values appearing across multiple client IDs.

What your security team should do

  • Prioritize kernel updates on all NFSv4.2 servers within the next maintenance window
  • Monitor for unusual volumes of OFFLOAD_CANCEL operations from individual clients
  • Restrict NFSv4.2 access to only trusted client networks where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st->si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid. Compare the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.

Affected packages

Ecosystem Package Introduced Fixed