UBUNTU-CVE-2026-89676: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy() called nfs4initcopystate() before dupcopyfields(), so the s2scpstateids IDR was pointed at &u->copy->cpstateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dupcopyfields() copies only the value into asynccopy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cstype from it and, if the bytes look like an expired NFS4COPYNOTIFYSTID, follows into refcountdec()/idrremove()/kfree() on garbage; managecpntfstate() has the same exposure via idrfind(). Duplicate the fields first, then register the stateid on the stable asynccopy. result->cbstateid is unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In nfsd's async COPY handling, call dup_copy_fields() to copy the fields into async_copy before registering the stateid in the s2s_cp_stateids IDR; do not register an IDR pointer to &u->copy->cp_stateid in the per-rqstp COMPOUND buffer.