CVE-2026-89694

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check client ownership when cancelling a copy-notify stateid

On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the

target cpntf state without checking ownership. The lookup key

st->si_opaque.so_id is allocated cyclically (guessable) and the embedded

clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated

NFSv4.2 client could cancel and free another client's copy-notify

stateid.

Compare the creating clientid recorded in state->cp_p_clid against the

requesting client's cl_clientid and return nfserr_bad_stateid on a

mismatch instead of freeing the entry.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References