CVE-2026-89684: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state
Summary
A race condition (a timing bug where two operations interfere with each other) exists in the Linux kernel's NFS server code. When creating a copy state entry, the code publishes it to a lookup table in one lock section, then adds it to a list in a separate lock section, leaving a window where another operation can find the entry but crash because the list is still empty. This allows any NFSv4.2 client to trigger a server crash by sending an OFFLOAD_CANCEL command.
Solution / Mitigation
The fix combines the assignment and list addition into a single lock section with the initial allocation, so concurrent lookups either miss the entry entirely or see it fully initialized. Additionally, INIT_LIST_HEAD() initializes the entry after allocation, and _free_cpntf_state_locked() is switched to list_del_init() so that stale unlink operations become harmless no-ops. The function nfs4_init_copy_state() is updated to pass NULL for p_stid and skip the list_add operation to preserve existing NFS4_COPY_STID behavior.
Vulnerability Details
EPSS: 0.0%
September 11, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-89684
First tracked: September 11, 2026 at 08:07 PM
Classified by LLM (prompt v3) · confidence: 95%