CVE-2026-89663: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89663 Overview

CVE-2026-89663 is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd) implementation. The flaw resides in how the kernel manages copy-notify stateids stored in the s2s_cp_stateids IDR and their parent stid's sc_cp_list. The revoke path drops the single membership reference without unlinking the entry when a concurrent reader has elevated cs_count, leaving the entry discoverable after its pinning reference has been consumed. A subsequent revoke or laundromat tick then frees the object while a reader still holds the pointer, producing a KASAN-detectable use-after-free at nfs4_put_cpntf_state().

Critical Impact
A remote authenticated NFSv4.2 client can trigger kernel memory corruption in nfsd, enabling denial of service and potential privilege escalation on affected Linux servers.

Affected Products

Linux kernel nfsd subsystem (NFSv4.2 server-to-server copy support)
Multiple stable kernel branches referenced by fix commits 06a62f6, 3b0c359, 5f00e0a, 6b81494, a1fca0f, b56d2c5, caddbeef, ff8a3cf
Linux distributions shipping vulnerable kernel builds with NFS server enabled

Discovery Timeline

2026-09-11 - CVE-2026-89663 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89663

Vulnerability Analysis

Copy-notify stateids live in the s2s_cp_stateids IDR and on the parent stid's sc_cp_list, pinned by a single membership reference. The helper _free_cpntf_state_locked() only unlinks an entry once its refcount reaches zero. When a revoke path executes while find_cpntf_state() or manage_cpntf_state() holds an elevated cs_count, the helper decrements the reference and returns early without unlinking the entry. The object remains discoverable through the IDR while its membership reference has already been consumed.

Three revoke paths share this defect. The parent-stid drain in nfs4_free_cpntf_statelist() repeatedly called _free_cpntf_state_locked() on the first list entry, causing a holder with a bumped cs_count to make the call return early and the next iteration to re-decrement the holder's reference. The OFFLOAD_CANCEL path via manage_cpntf_state() and the laundromat expiry path exhibited the same 2→1 decrement without unlinking. A second revoke or laundromat tick then frees the entry while the reader still holds the pointer.

Root Cause

The root cause is a reference-counting and unlink ordering bug in Linux NFSD copy-notify stateid teardown. The revoke logic conflated "drop reference" with "remove from lookup structures," allowing an entry to remain in the IDR and sc_cp_list after its pinning reference had been dropped. The upstream fix introduces revoke_cpntf_state_locked(), which unhashes the entry from the IDR and sc_cp_list first and defers the final free to any remaining holder.

Attack Vector

Exploitation requires an authenticated NFSv4.2 client capable of issuing server-to-server copy operations against a vulnerable nfsd instance. An attacker races copy-notify state lookup operations against revoke triggers such as OFFLOAD_CANCEL or laundromat expiry to reach the use-after-free window. Successful exploitation can corrupt kernel memory, crash the server, or provide a primitive for privilege escalation depending on heap layout and allocator behavior.

No public exploit code is available for CVE-2026-89663. Refer to the upstream fix commits linked below for technical details on the patched code paths.

Detection Methods for CVE-2026-89663

Indicators of Compromise

KASAN reports referencing nfs4_put_cpntf_state, _free_cpntf_state_locked, or nfs4_free_cpntf_statelist in kernel logs
Unexpected nfsd kernel oops or panic entries in dmesg and /var/log/messages on servers exposing NFSv4.2 copy support
Repeated NFSv4.2 OFFLOAD_CANCEL operations from a single client immediately preceding kernel crashes

Detection Strategies

Enable KASAN on test kernels to surface use-after-free hits in the copy-notify stateid code paths
Correlate NFSv4.2 copy-notify request bursts with kernel warning or oops events across fleet telemetry
Track kernel build fingerprints against the fix commit hashes to identify hosts still exposed

Monitoring Recommendations

Ingest dmesg, /var/log/kern.log, and journald kernel streams into a centralized data lake for anomaly analysis
Alert on nfsd thread crashes and unexpected NFS server restarts on internet-adjacent or multi-tenant hosts
Monitor NFSv4.2 client behavior for anomalous rates of copy, copy-notify, and offload-cancel operations

How to Mitigate CVE-2026-89663

Immediate Actions Required

Update affected Linux kernels to a stable release that includes the revoke_cpntf_state_locked() fix
Restrict NFSv4.2 server access to trusted network segments and authenticated clients only
Audit which hosts export NFS shares with server-to-server copy enabled and prioritize their patching

Patch Information

The upstream fix is available through multiple stable kernel commits: Kernel Git Commit 06a62f6, Kernel Git Commit 3b0c359, Kernel Git Commit 5f00e0a, Kernel Git Commit 6b81494, Kernel Git Commit a1fca0f, Kernel Git Commit b56d2c5, Kernel Git Commit caddbeef, and Kernel Git Commit ff8a3cf. Apply the vendor-backported kernel package from your Linux distribution as soon as it becomes available.

Workarounds

Disable NFSv4.2 server-to-server copy support where operationally feasible until patched kernels are deployed
Firewall NFS ports (TCP/UDP 2049 and associated RPC ports) to permit only trusted client networks
Require Kerberos-based authentication (sec=krb5) on NFS exports to raise the barrier to abuse

bash

# Restrict NFS server access with firewalld until patched
sudo firewall-cmd --permanent --zone=public --remove-service=nfs
sudo firewall-cmd --permanent --zone=trusted --add-service=nfs
sudo firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/8
sudo firewall-cmd --reload

# Verify running kernel version against distro advisory
uname -r