CVE-2026-89663

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free flaw exists in the nfsd copy-notify stateids. The issue occurs because free cpntf state locked() only unlinks an entry when its reference count reaches zero. If a revoke path executes while a concurrent holder of find cpntf state() or manage cpntf state() has an elevated cs count, the reference is dropped without unlinking. This leaves the entry discoverable despite its membership reference being consumed. Subsequent revoke actions or laundromat ticks can then free the entry while a reader still holds the pointer, leading to a use-after-free condition at nfs4 put cpntf state(). This affects the parent-stid drain via nfs4 free cpntf statelist(), OFFLOAD CANCEL via manage cpntf state(), and laundromat expiry.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.