CVE-2026-89675

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix UAF in async copy cancel and shutdown

An async copy could be freed or used after free while a teardown caller

(OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the

copy kthread:

- find_async_copy() bumped copy->refcount but left the copy on

clp->async_copies, so the reaper's cleanup_async_copy() could run

release_copy_files() concurrently with a cancel/shutdown caller. Both

put and NULL nf_src/nf_dst without a common lock, double-putting the

nfsd_file and freeing it early.

- nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses

of the copy (nfsd_update_cmtime_attr() on copy->nf_dst,

nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit

as "kthread done, skip kthread_stop()", so a teardown caller ran

release_copy_files() -- which puts and NULLs nf_dst -- while the

kthread still dereferenced it (NULL/UAF).

- copy->co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References