CVE-2026-89684
Description
A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOAD_CANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a denial of service (DoS) by causing the server to crash.
Statement
A server side race in NFSD COPY_NOTIFY state publication can make a new cpntf state reachable through the s2s_cp_stateids IDR before its cp_list entry is fully linked. A racing NFSv4.2 client can use the echoed cnr_stateid in OFFLOAD_CANCEL to reach manage_cpntf_state and free the partially published object, which can cause list_del on an uninitialized list_head, a kernel oops, and a server DoS. The same publish before link pattern is a use-after-free candidate because the allocation path may continue after the racing cancel has dropped the last reference and freed the cpntf object. For the CVSS the PR:L is used for the paranoid score because the attacker generally needs access as an NFSv4.2 client able to drive COPY_NOTIFY and OFFLOAD_CANCEL, but does not need local privileges on the server. The issue is network reachable through the NFS server control path and is most relevant on internal storage or data center networks where NFSv4.2 server side copy features are exposed. Impact is at least remote denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to a race based use-after-free candidate.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
