Linux nfsd: copy-notify stateid published before initialisation, freeable by a racing OFFLOAD_CANCEL

Impact

nfsd4_copy_notify() linked the new copy-notify state into the s2s_cp_stateids IDR and the parent's sc_cp_list before finishing initialisation and without holding a caller reference. A racing OFFLOAD_CANCEL that supplies the well-known clientid and a guessable so_id can reach manage_cpntf_state() and free the entry, turning the caller's subsequent reads and writes of the stateid into use-after-free in the file server's kernel. The owning clientid was recorded only after publication, so no ownership check could close the window. On a shared storage node this is a remotely driven kernel memory-corruption primitive affecting every tenant mounting the export.

Who can reach it

A client that can mount the export and issue NFSv4.2 COPY_NOTIFY concurrently with OFFLOAD_CANCEL carrying the crafted clientid. Export authentication applies; no server-local access needed.

What to do

Upgrade to a stable kernel containing the referenced commits and reboot the NFS server, draining or failing over clients first. Servers whose clients never use inter-server copy do not exercise COPY_NOTIFY. The record names commits, not fixed release numbers.

References

Related entries

• Linux nfsd: localio cmpxchg retry runs outside RCU, bumping a refcount on recycled memoryCVE-2026-89670 · Linux kernel nfsd (localio nfsd_open_local_fh)Unscored
• Linux nfsd: NFSACL SETACL ignores the request mask and silently deletes the omitted ACLCVE-2026-89671 · Linux kernel nfsd (NFSACL v2/v3 SETACL mask handling)Unscored
• Linux nfsd: flexfiles GETDEVICEINFO over-reserves da_addr_body and leaks reply-page memoryCVE-2026-89673 · Linux kernel nfsd (pNFS flexfiles GETDEVICEINFO XDR encoder)Unscored
• Linux nfsd: flexfiles LAYOUTGET XDR size miscalculation writes past the reply bufferCVE-2026-89674 · Linux kernel nfsd (pNFS flexfiles LAYOUTGET XDR encoder)Unscored
• Linux nfsd: use-after-free when OFFLOAD_CANCEL or shutdown races the async COPY kthreadCVE-2026-89675 · Linux kernel nfsd (NFSv4.2 async server-side COPY teardown)Unscored
• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored