CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it
In the Linux kernel, the following vulnerability has been resolved:
nfsd: initialize copy-notify stateid before publishing it
nfsd4copynotify() finished initializing the cpntf state after nfs4allocinitcpntfstate() had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscount == 1 (the membership reference) and none held for the caller. A racing OFFLOADCANCEL (crafted clid == nn->s2scpclid plus the guessable soid) could reach managecpntfstate() and free the entry, turning the caller's subsequent cpncnrstateid read and cppstateid/cppclid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window.
Record cppstateid and cppclid inside nfs4allocinitcpntfstate() before nfs4initcpstate() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4putcpntfstate(); on a late error the laundromat reaps the entry.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to trigger the use-after-free?
The attacker needs to race an OFFLOAD_CANCEL request against copy-notify state initialization. The request must use cl_id equal to nn->s2s_cp_cl_id and a guessable so_id to reach the affected state-management path.
Which systems are realistically exposed?
Systems are exposed when the Linux kernel NFS server code reaches the nfsd4_copy_notify() path and can process the racing OFFLOAD_CANCEL request. The provided information does not establish whether this path is enabled or reachable in a default configuration.
What change resolves the race?
The fix records the parent stateid and client ID before the copy-notify entry is published, then gives the caller an additional reference while it reads the stateid. This prevents a racing cancellation from freeing the entry before the caller completes its initialization work.