Linux nfsd: copy-notify stateid freed while still discoverable, a use-after-free on all three revoke paths

Impact

Copy-notify stateids are pinned by a single membership reference in the s2s_cp_stateids IDR and on the parent stid's sc_cp_list. _free_cpntf_state_locked() only unlinks an entry once its refcount hits zero, so any revoke that runs while a concurrent find_cpntf_state()/manage_cpntf_state() holder has raised cs_count drops the reference without unlinking - leaving the entry discoverable with its membership reference already spent. A second revoke or a laundromat tick then frees it under the reader, a KASAN-detectable use-after-free at nfs4_put_cpntf_state(). All three revoke paths were affected: the parent-stid drain, OFFLOAD_CANCEL, and laundromat expiry. The reachable trigger is NFSv4.2 server-to-server copy traffic, so fleets that do not use inter-server COPY are less exposed; where it is used, the outcome is a crash of a shared NFS server.

Who can reach it

NFSv4.2 clients performing server-to-server COPY against the server, racing OFFLOAD_CANCEL or laundromat expiry. Authenticated NFS client access is needed; no local privilege on the server is described.

What to do

Update the NFS server host to a stable kernel carrying the fix (four backport commits linked on the record); it adds revoke_cpntf_state_locked(), which unhashes from the IDR and sc_cp_list before dropping the reference, and uses it on all three revoke paths. nfsd is in-kernel, so remediation is a reboot of the server node, best batched with the other nfsd fixes from the same day.

References

Related entries

• Linux nfsd: POSIX ACL refs leak on every malformed NFSv4 OPEN compoundCVE-2026-89664 · Linux kernel nfsd (NFSv4 OPEN compound POSIX ACL release)Unscored
• Linux nfsd: unvalidated NFSv3 nseconds corrupts on-disk timestamps on ext4 and XFSCVE-2026-89666 · Linux kernel nfsd (NFSv3 SETATTR/CREATE timestamp validation)Unscored
• Linux nfsd: copy-notify stateid published before initialisation, freeable by a racing OFFLOAD_CANCELCVE-2026-89669 · Linux kernel nfsd (NFSv4.2 COPY_NOTIFY stateid)Unscored
• Linux nfsd: localio cmpxchg retry runs outside RCU, bumping a refcount on recycled memoryCVE-2026-89670 · Linux kernel nfsd (localio nfsd_open_local_fh)Unscored
• Linux nfsd: NFSACL SETACL ignores the request mask and silently deletes the omitted ACLCVE-2026-89671 · Linux kernel nfsd (NFSACL v2/v3 SETACL mask handling)Unscored
• Linux nfsd: flexfiles GETDEVICEINFO over-reserves da_addr_body and leaks reply-page memoryCVE-2026-89673 · Linux kernel nfsd (pNFS flexfiles GETDEVICEINFO XDR encoder)Unscored