Linux kernel nfsd: race between cpntf publish and OFFLOAD_CANCEL oopses on an uninitialised list head

Impact

The new copy-notify entry is published into the s2s_cp_stateids IDR before it is linked onto sc_cp_list, leaving a window where the entry is reachable by so_id with a zeroed list_head. Because so_id is echoed to the client as cnr_stateid, any NFSv4.2 client can drive an OFFLOAD_CANCEL into that window and make the server list_del a {NULL,NULL} node, crashing it. Server-to-server COPY is what dataset staging and checkpoint moves use, so on a busy fleet the race is hit by ordinary traffic, and the blast radius is every node with the export mounted.

Who can reach it

Any NFSv4.2 client that can perform a server-side COPY and then send OFFLOAD_CANCEL for the returned stateid. Requires whatever authentication your export demands to issue the COPY; no special privilege beyond that.

What to do

Update the host kernel to a stable release that folds the cs_type assignment and list_add into the idr_alloc_cyclic critical section, then reboot the NFS server. As an interim measure, disabling server-to-server COPY on the export removes the code path; there is no live patch described.

References

Related entries

• Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitelyCVE-2026-89685 · Linux kernel nfsd clients_still_reclaiming() (grace period deadline)High
• Linux kernel nfsd: file returned by dentry_create() may not actually be open before useCVE-2026-89687 · Linux kernel nfsd_file_do_acquire() (dentry_create / atomic_open result handling)High
• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High