{"api_version":"1","generated_at":"2026-10-16T22:07:52+00:00","cve":"CVE-2026-89676","urls":{"html":"https://cve.report/CVE-2026-89676","api":"https://cve.report/api/cve/CVE-2026-89676.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89676","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89676"},"summary":{"title":"nfsd: fix stale s2s_cp_stateids IDR entry for async COPY","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result->cb_stateid is unchanged.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:54","updated_at":"2026-10-16 20:18:26"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9","name":"https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a","name":"https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114","name":"https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02","name":"https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89676","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89676","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 7aa34ea78f74e6ef60c8112635a87fc43d57f6c9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 14b978e8d05ce018d0afbeb6611833ef91713a02 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 d0beaee498e11880e72826026db0e9c9890fc114 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.20","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.20 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.111 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"89676","cve":"CVE-2026-89676","epss":"0.004630000","percentile":"0.393790000","score_date":"2026-09-22","updated_at":"2026-09-23 00:06:34"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-89676","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T19:25:55.766709Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-16T19:26:48.523Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/nfsd/nfs4proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7aa34ea78f74e6ef60c8112635a87fc43d57f6c9","status":"affected","version":"e0639dc5805a9d4faaa2c07ad98fa853b9529dd3","versionType":"git"},{"lessThan":"9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a","status":"affected","version":"e0639dc5805a9d4faaa2c07ad98fa853b9529dd3","versionType":"git"},{"lessThan":"14b978e8d05ce018d0afbeb6611833ef91713a02","status":"affected","version":"e0639dc5805a9d4faaa2c07ad98fa853b9529dd3","versionType":"git"},{"lessThan":"d0beaee498e11880e72826026db0e9c9890fc114","status":"affected","version":"e0639dc5805a9d4faaa2c07ad98fa853b9529dd3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/nfsd/nfs4proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.111","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"4.20","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result->cb_stateid is unchanged."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - The dangling s2s_cp_stateids pointer is installed by nfsd4_copy in the in-kernel NFSv4.2 server; a remote client reaches it over TCP/2049 via COMPOUND RPCs (EXCHANGE_ID, CREATE_SESSION, OPEN, then async COPY).\nAC:L - The attacker reliably creates the stale IDR entry with async COPY, then either reuses that nfsd thread's COMPOUND iops buffer with further requests or sends a >8-op compound so the vcalloc'd ops array is kvfree_rcu'd, and later walks the IDR via OFFLOAD_CANCEL/READ or the laundromat; no condition outside attacker control is required.\nPR:N - Typical nfsd deployments use AUTH_SYS or AUTH_NULL with IP-based exports, so a remote peer that can reach the export can create an NFSv4.2 session, OPEN readable and writable files, and issue async COPY without a local account or capability on the NFS server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export; no victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The stale IDR dereference corrupts kernel nfsd copy and copy-notify state on the NFS server host and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The IDR retains a pointer into reused per-rqstp COMPOUND memory or a kvfree_rcu'd ops array; the laundromat and manage_cpntf_state then read cs_type and adjacent fields from attacker-controlled reused or sprayed memory, a use-after-free disclosure primitive.\nI:H - When reused bytes look like an expired NFS4_COPYNOTIFY_STID, the laundromat and manage_cpntf_state perform list_del, refcount_dec, and kfree on the garbage object, a use-after-free write/free primitive that enables heap corruption and control-flow hijacking.\nA:H - kfree or list_del on the dangling COMPOUND buffer or sprayed slab oopses or panics nfsd worker threads, and the attacker can repeat async COPY plus IDR walks to take down the NFS server host."}]}],"providerMetadata":{"dateUpdated":"2026-09-21T13:14:43.984Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9"},{"url":"https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a"},{"url":"https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02"},{"url":"https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114"}],"title":"nfsd: fix stale s2s_cp_stateids IDR entry for async COPY","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89676","datePublished":"2026-09-11T19:46:00.382Z","dateReserved":"2026-09-11T19:38:34.747Z","dateUpdated":"2026-10-16T19:26:48.523Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:54","lastModifiedDate":"2026-10-16 20:18:26","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T19:25:55.766709Z","id":"CVE-2026-89676","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89676","Ordinal":"1","Title":"nfsd: fix stale s2s_cp_stateids IDR entry for async COPY","CVE":"CVE-2026-89676","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89676","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result->cb_stateid is unchanged.","Type":"Description","Title":"nfsd: fix stale s2s_cp_stateids IDR entry for async COPY"}]}}}