CVE-2026-89669

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1

Description A use-after-free issue exists in the nfsd4 copy notify() function. The cpntf state was being initialized after nfs4 alloc init cpntf state() had already linked it into the s2s cp stateids IDR and the parent's sc cp list. A racing OFFLOAD CANCEL request with a crafted cl id and a guessable so id could trigger manage cpntf state() to free the entry. This allows subsequent reads of cpn cnr stateid and writes to cp p stateid and cp p clid to occur after the memory has been freed. Additionally, the owning client ID was recorded after publication, preventing an ownership check during this window.

Recommendations Update the Linux kernel to version 7.2.6-1.1 or later.