{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89676", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.747Z", "datePublished": "2026-09-11T19:46:00.382Z", "dateUpdated": "2026-10-21T12:48:16.727Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:48:16.727Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result->cb_stateid is unchanged."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The dangling s2s_cp_stateids pointer is installed by nfsd4_copy in the in-kernel NFSv4.2 server; a remote client reaches it over TCP/2049 via COMPOUND RPCs (EXCHANGE_ID, CREATE_SESSION, OPEN, then async COPY).\nAC:L - The attacker reliably creates the stale IDR entry with async COPY, then either reuses that nfsd thread's COMPOUND iops buffer with further requests or sends a >8-op compound so the vcalloc'd ops array is kvfree_rcu'd, and later walks the IDR via OFFLOAD_CANCEL/READ or the laundromat; no condition outside attacker control is required.\nPR:N - Typical nfsd deployments use AUTH_SYS or AUTH_NULL with IP-based exports, so a remote peer that can reach the export can create an NFSv4.2 session, OPEN readable and writable files, and issue async COPY without a local account or capability on the NFS server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export; no victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The stale IDR dereference corrupts kernel nfsd copy and copy-notify state on the NFS server host and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The IDR retains a pointer into reused per-rqstp COMPOUND memory or a kvfree_rcu'd ops array; the laundromat and manage_cpntf_state then read cs_type and adjacent fields from attacker-controlled reused or sprayed memory, a use-after-free disclosure primitive.\nI:H - When reused bytes look like an expired NFS4_COPYNOTIFY_STID, the laundromat and manage_cpntf_state perform list_del, refcount_dec, and kfree on the garbage object, a use-after-free write/free primitive that enables heap corruption and control-flow hijacking.\nA:H - kfree or list_del on the dangling COMPOUND buffer or sprayed slab oopses or panics nfsd worker threads, and the attacker can repeat async COPY plus IDR walks to take down the NFS server host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4proc.c"], "versions": [{"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "bdce362f49410b9def65d76c21f6259cd89696d8", "status": "affected", "versionType": "git"}, {"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "7aa34ea78f74e6ef60c8112635a87fc43d57f6c9", "status": "affected", "versionType": "git"}, {"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a", "status": "affected", "versionType": "git"}, {"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "14b978e8d05ce018d0afbeb6611833ef91713a02", "status": "affected", "versionType": "git"}, {"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "d0beaee498e11880e72826026db0e9c9890fc114", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4proc.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bdce362f49410b9def65d76c21f6259cd89696d8"}, {"url": "https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9"}, {"url": "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a"}, {"url": "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02"}, {"url": "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"}], "title": "nfsd: fix stale s2s_cp_stateids IDR entry for async COPY", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:25:55.766709Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:48.523Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:25:55.766709Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:25:57.001Z"}}], "cna": {"title": "nfsd: fix stale s2s_cp_stateids IDR entry for async COPY", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The dangling s2s_cp_stateids pointer is installed by nfsd4_copy in the in-kernel NFSv4.2 server; a remote client reaches it over TCP/2049 via COMPOUND RPCs (EXCHANGE_ID, CREATE_SESSION, OPEN, then async COPY).\nAC:L - The attacker reliably creates the stale IDR entry with async COPY, then either reuses that nfsd thread's COMPOUND iops buffer with further requests or sends a >8-op compound so the vcalloc'd ops array is kvfree_rcu'd, and later walks the IDR via OFFLOAD_CANCEL/READ or the laundromat; no condition outside attacker control is required.\nPR:N - Typical nfsd deployments use AUTH_SYS or AUTH_NULL with IP-based exports, so a remote peer that can reach the export can create an NFSv4.2 session, OPEN readable and writable files, and issue async COPY without a local account or capability on the NFS server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export; no victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The stale IDR dereference corrupts kernel nfsd copy and copy-notify state on the NFS server host and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The IDR retains a pointer into reused per-rqstp COMPOUND memory or a kvfree_rcu'd ops array; the laundromat and manage_cpntf_state then read cs_type and adjacent fields from attacker-controlled reused or sprayed memory, a use-after-free disclosure primitive.\nI:H - When reused bytes look like an expired NFS4_COPYNOTIFY_STID, the laundromat and manage_cpntf_state perform list_del, refcount_dec, and kfree on the garbage object, a use-after-free write/free primitive that enables heap corruption and control-flow hijacking.\nA:H - kfree or list_del on the dangling COMPOUND buffer or sprayed slab oopses or panics nfsd worker threads, and the attacker can repeat async COPY plus IDR walks to take down the NFS server host."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "bdce362f49410b9def65d76c21f6259cd89696d8", "versionType": "git"}, {"status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "7aa34ea78f74e6ef60c8112635a87fc43d57f6c9", "versionType": "git"}, {"status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a", "versionType": "git"}, {"status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "14b978e8d05ce018d0afbeb6611833ef91713a02", "versionType": "git"}, {"status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "lessThan": "d0beaee498e11880e72826026db0e9c9890fc114", "versionType": "git"}], "programFiles": ["fs/nfsd/nfs4proc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.111", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfsd/nfs4proc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bdce362f49410b9def65d76c21f6259cd89696d8"}, {"url": "https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9"}, {"url": "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a"}, {"url": "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02"}, {"url": "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result->cb_stateid is unchanged."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.111", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.50", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.4", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3", "versionStartIncluding": "4.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:48:16.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-89676", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:48:16.727Z", "dateReserved": "2026-09-11T19:38:34.747Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-09-11T19:46:00.382Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bdce362f49410b9def65d76c21f6259cd89696d8", "status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "versionType": "git"}, {"lessThan": "7aa34ea78f74e6ef60c8112635a87fc43d57f6c9", "status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "versionType": "git"}, {"lessThan": "9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a", "status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "versionType": "git"}, {"lessThan": "14b978e8d05ce018d0afbeb6611833ef91713a02", "status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "versionType": "git"}, {"lessThan": "d0beaee498e11880e72826026db0e9c9890fc114", "status": "affected", "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result->cb_stateid is unchanged."}], "id": "CVE-2026-89676", "lastModified": "2026-10-21T13:20:19.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89676", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:25:55.766709Z", "version": "2.0.3"}}]}, "published": "2026-09-11T20:19:54.273", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bdce362f49410b9def65d76c21f6259cd89696d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Memory corruption in nfsd due to stale IDR entry in async COPY", "id": "2532219", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532219"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. When performing an asynchronous (async) copy operation, a programming error causes a stale identifier (IDR) entry to point to memory that has already been reused. This can lead to memory corruption, where the system attempts to access or free invalid memory. Such an issue could result in system instability or a denial of service (DoS), making the system unavailable to legitimate users."], "name": "CVE-2026-89676", "public_date": "2026-09-11T19:46:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89676\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89676\nhttps://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02\nhttps://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a\nhttps://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"], "threat_severity": "Moderate"}