CVE-2026-89694 nfsd: check client ownership when cancelling a copy-notify stateid
An authenticated NFSv4.2 client can cancel another client's copy-notify stateid due to missing ownership checks, causing denial of service or data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89694?
CVE-2026-89694 is a missing authorization vulnerability in Linux, published on 11 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: check client ownership when cancelling a copy-notify stateid
On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st->si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid.
Compare the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.
Which versions are affected by CVE-2026-89694?
How do I fix CVE-2026-89694?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-89694 being exploited?
There is no known exploitation of CVE-2026-89694 in the wild and no public exploit code.
Sources
Also known as AZL-100175, BELL-CVE-2026-89694, DEBIAN-CVE-2026-89694, GHSA-79r3-v437-qvqg, UBUNTU-CVE-2026-89694.