CVE-2026-89663

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: revoke copy-notify stateids before dropping their reference

Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent

stid's sc_cp_list, pinned by a single membership reference.

_free_cpntf_state_locked() only unlinks an entry once its refcount reaches

zero, so any revoke path that runs while a concurrent

find_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops

the reference without unlinking, leaving the entry discoverable with its

membership reference already consumed. A second revoke or a laundromat tick

then frees it while the reader still holds the pointer -- a

KASAN-detectable use-after-free at the reader's nfs4_put_cpntf_state().

This affected all three revoke paths:

- The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called

_free_cpntf_state_locked() on the first list entry; a holder that had

bumped cs_count made it return early, so the next iter

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References