CVE-2026-89694
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st->si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid. Compare the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.
How to fix
- Linux Linux88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9, 81b2cfe767943922eca906a2a5af23a0ce5d0f35, 6bba72b8ee68ad631b94bd439592cba46de54d7d, 75268f6cfe26b09a7e4d3216367e87fe9e2a26aa, b1eca07303594ca27f5dc360a6946bd7e1f5b04c, b42dc26a14b4ad5d6daaada11ec4c70744141c25, d801906165cb5cc250d5cbe44935594e170be3e2, 6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | ce0887ac96d35c7105090e166bb0807dc0a0e838 ≤ v < 88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9, ce0887ac96d35c7105090e166bb0807dc0a0e838 ≤ v < 81b2cfe767943922eca906a2a5af23a0ce5d0f35, ce0887ac96d35c7105090e166bb0807dc0a0e838 ≤ v < 6bba72b8ee68ad631b94bd439592cba46de54d7d, ce0887ac96d35c7105090e166bb0807dc0a0e838 ≤ v < 75268f6cfe26b09a7e4d3216367e87fe9e2a26aa, ce0887ac96d35c7105090e166bb0807dc0a0e838 ≤ v < b1eca07303594ca27f5dc360a6946bd7e1f5b04c, ce0887ac96d35c7105090e166bb0807dc0a0e838 ≤ v < b42dc26a14b4ad5d6daaada11ec4c70744141c25, ce0887ac96d35c7105090e166bb0807dc0a0e838 ≤ v < d801906165cb5cc250d5cbe44935594e170be3e2, ce0887ac96d35c7105090e166bb0807dc0a0e838 ≤ v < 6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf, 5.6 | 88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9, 81b2cfe767943922eca906a2a5af23a0ce5d0f35, 6bba72b8ee68ad631b94bd439592cba46de54d7d, 75268f6cfe26b09a7e4d3216367e87fe9e2a26aa, b1eca07303594ca27f5dc360a6946bd7e1f5b04c, b42dc26a14b4ad5d6daaada11ec4c70744141c25, d801906165cb5cc250d5cbe44935594e170be3e2, 6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.