CVE-2026-89694

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nfsd component where the manage cpntf state() function fails to verify client ownership when cancelling a copy-notify stateid on the OFFLOAD CANCEL path. Because the lookup key st->si opaque.so id is allocated cyclically and is therefore guessable, and the embedded clientid uses a fixed per-net nn->s2s cp cl id, an authenticated NFSv4.2 client can cancel and free the copy-notify stateid belonging to another client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.