CVE-2026-89684 nfsd: fix cpntf publish race in nfs4_init_cp_state
A race condition in the Linux kernel NFS server allows a remote attacker to cause a system crash via a crafted OFFLOAD_CANCEL request.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89684?
CVE-2026-89684 is a high-severity vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix cpntf publish race in nfs4_init_cp_state
nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server.
Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.
Which versions are affected by CVE-2026-89684?
How do I fix CVE-2026-89684?
Apply the vendor's patch.
Is CVE-2026-89684 being exploited?
There is no known exploitation of CVE-2026-89684 in the wild and no public exploit code.
Sources
Also known as AZL-100653, BELL-CVE-2026-89684, DEBIAN-CVE-2026-89684, GHSA-83g2-j7m2-94hx, UBUNTU-CVE-2026-89684.