Linux nfsd: async server-side COPY registers a stateid pointing into a reused request buffer

Impact

nfsd4_copy() registered the copy stateid in the s2s_cp_stateids IDR before duplicating the fields, so the IDR slot pointed at memory in the per-rqstp COMPOUND buffer that the next request reuses. Any IDR walker - the laundromat, or manage_cpntf_state() via idr_find() - then dereferences recycled request memory and can be steered into refcount_dec(), idr_remove() and kfree() on attacker-influenced bytes. On a GPU cluster whose scratch or dataset tier is served by a Linux NFS server, a client that issues async COPY can corrupt server-side kernel state; the NFS server is a single point of failure for every node that mounts it, so a crash or compromise there stalls the whole fleet, not one tenant.

Who can reach it

Any NFSv4.2 client permitted to mount the export and issue an asynchronous server-side COPY. Standard NFS authentication only - no privilege on the server is needed.

What to do

Patch the NFS server kernel with one of the linked stable commits and reboot it; nfsd runs in-kernel, so no daemon restart is sufficient. Plan for the export to be unavailable during the reboot, or fail over to a second server first. Disabling NFSv4.2 server-side copy on the export removes the reachable path if a reboot cannot be scheduled.

References

Related entries

• Linux nfsd: filehandle composed from a stale dentry when dentry_create returns a different dentryCVE-2026-89677 · Linux NFS server (nfsd4_create_file, fh_compose on the wrong dentry)Critical
• Linux nfsd: pNFS layout fence worker takes a duplicate reference and leaks the layout stateidCVE-2026-89681 · Linux NFS server (nfsd pNFS layout fence worker, lm_breaker_timedout)Critical
• Linux nfsd: LAYOUTGET racing a delegation revoke hits a BUG_ON and panics the NFS serverCVE-2026-89686 · Linux NFS server (nfsd4_alloc_layout_stateid, fi_deleg_file under fi_lock)Critical
• Linux nfsd: seqid_op replay retry drops a stateowner reference it never tookCVE-2026-89688 · Linux NFS server (nfs4_preprocess_seqid_op, stateowner refcount on replay retry)Critical
• Linux nfsd: session slot shrinker frees the slot in use, corrupting the slab with reply dataCVE-2026-89689 · Linux NFS server (nfsd4_sequence session slot shrinker, free_session_slots)Critical
• Linux nfsd: fh_verify tracepoints size the server address slot wrongly, writing past the trace bufferCVE-2026-89702 · Linux NFS server (nfsd_fh_verify tracepoints, server sockaddr slot sizing)Critical