CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid
In the Linux kernel, the following vulnerability has been resolved:
nfsd: check client ownership when cancelling a copy-notify stateid
On the OFFLOADCANCEL path (clp != NULL), managecpntfstate() freed the target cpntf state without checking ownership. The lookup key st->siopaque.soid is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2scpclid, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid.
Compare the creating clientid recorded in state->cppclid against the requesting client's clclientid and return nfserrbadstateid on a mismatch instead of freeing the entry.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated NFSv4.2 client can exploit it. The vulnerable path is OFFLOAD_CANCEL for copy-notify stateids.
What does an attacker need to do?
The attacker needs to submit an OFFLOAD_CANCEL request for another client's copy-notify stateid. The stateid lookup ID is allocated cyclically and is therefore guessable, while the embedded clientid is fixed per network namespace.
What is the impact of a successful exploit?
A successful request can cancel and free another client's copy-notify stateid. The corrected behavior rejects a request when the creating clientid does not match the requesting client's clientid, returning nfserr_bad_stateid.