CVE-2026-89676nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
- 9.8CriticalCVSS base score
- 0.49%Exploitation in 30 daysEPSS · top 57% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dup_copy_fields() copies only the value into async_copy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cs_type from it and, if the bytes look like an expired NFS4_COPYNOTIFY_STID, follows into refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has the same exposure via idr_find(). Duplicate the fields first, then register the stateid on the stable async_copy. result->cb_stateid is unchanged.
Timeline
ID reserved
By Linux
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.49% · top 57% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 – < 745b2edfdd96b8738a94dee450adff4c7d026d5b
- affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 – < bdce362f49410b9def65d76c21f6259cd89696d8
- affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 – < 7aa34ea78f74e6ef60c8112635a87fc43d57f6c9
- affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 – < 9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a
- affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 – < 14b978e8d05ce018d0afbeb6611833ef91713a02
- affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 – < d0beaee498e11880e72826026db0e9c9890fc114
- affected 4.20
- unaffected < 4.20
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/745b2edfdd96b8738a94dee450adff4c7d026d5b (opens in a new tab)
- https://git.kernel.org/stable/c/bdce362f49410b9def65d76c21f6259cd89696d8 (opens in a new tab)
- https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9 (opens in a new tab)
- https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a (opens in a new tab)
- https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02 (opens in a new tab)
- https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76588 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89676)Record last updated .