Linux kernel nfsd: race between cpntf publish and OFFLOAD_CANCEL oopses on an uninitialised list head

Impact

The new copy-notify entry is published into the s2s_cp_stateids IDR before it is linked onto sc_cp_list, leaving a window where the entry is reachable by so_id with a zeroed list_head. Because so_id is echoed to the client as cnr_stateid, any NFSv4.2 client can drive an OFFLOAD_CANCEL into that window and make the server list_del a {NULL,NULL} node, crashing it. Server-to-server COPY is what dataset staging and checkpoint moves use, so on a busy fleet the race is hit by ordinary traffic, and the blast radius is every node with the export mounted.

Who can reach it

Any NFSv4.2 client that can perform a server-side COPY and then send OFFLOAD_CANCEL for the returned stateid. Requires whatever authentication your export demands to issue the COPY; no special privilege beyond that.

What to do

Update the host kernel to a stable release that folds the cs_type assignment and list_add into the idr_alloc_cyclic critical section, then reboot the NFS server. As an interim measure, disabling server-to-server COPY on the export removes the code path; there is no live patch described.

References

Related entries

• Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitelyCVE-2026-89685 · Linux kernel nfsd clients_still_reclaiming() (grace period deadline)High
• Linux kernel nfsd: file returned by dentry_create() may not actually be open before useCVE-2026-89687 · Linux kernel nfsd_file_do_acquire() (dentry_create / atomic_open result handling)High
• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High
• Linux nvmet-tcp: unsolicited H2CData PDU double-completes a command and wedges the targetCVE-2026-89968 · Linux kernel nvmet-tcp (NVMe-oF TCP target)High
• Linux NVMe host: a positive Identify status is ignored and a zoned queue is set up with zero zone sizeCVE-2026-89971 · Linux kernel NVMe host (zoned namespace limits update)High
• Linux nvme-fc: double free of fabrics options when nvme_add_ctrl() fails during connectCVE-2026-89974 · Linux kernel nvme-fc (fabrics options ownership on controller init failure)High