Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-11T00:00:00 kernel: nfsd: check client ownership when cancelling a copy-notify stateid 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-639

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st->si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid. Compare the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.

A flaw was found in the Linux kernel's NFSv4.2 server (nfsd). An authenticated NFSv4.2 client could exploit a vulnerability in the `manage_cpntf_state()` function by guessing a state identifier. This improper ownership check allows the client to cancel and free another client's copy-notify stateid, leading to a Denial of Service (DoS) for the legitimate client.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 10 Fix deferred kernel-rt Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-89694 https://nvd.nist.gov/vuln/detail/CVE-2026-89694 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89694.mbox