CVE-2026-89669: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89669 Overview

CVE-2026-89669 is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd4_copy_notify(), which finished initializing the copy-notify (cpntf) state after nfs4_alloc_init_cpntf_state() had already published the entry into the s2s_cp_stateids IDR and the parent's sc_cp_list. A racing OFFLOAD_CANCEL request with a crafted cl_id matching nn->s2s_cp_cl_id and a guessable so_id can reach manage_cpntf_state() and free the entry, converting the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free operations.

Critical Impact
Remote unauthenticated attackers can trigger a race condition in the NFS server, potentially leading to kernel memory corruption and remote code execution over the network.

Affected Products

Linux Kernel (nfsd subsystem)
Systems exposing NFSv4.2 server-side copy functionality
Distributions shipping affected mainline and stable kernel branches

Discovery Timeline

2026-09-11 - CVE-2026-89669 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89669

Vulnerability Analysis

The vulnerability is a race condition leading to a use-after-free [CWE-416] in the NFSv4.2 server-side copy notification handling. The NFS server allocates a copy-notify stateid structure and links it into the shared s2s_cp_stateids IDR (integer ID radix tree) and the parent client's sc_cp_list before the caller finishes initializing critical fields.

During the exposure window, the structure holds only its membership reference (cs_count == 1) and no reference is held on behalf of the caller. A concurrent OFFLOAD_CANCEL operation that targets the newly published entry can invoke manage_cpntf_state() and free the memory. When the original caller subsequently reads cpn_cnr_stateid and writes to cp_p_stateid and cp_p_clid, it operates on freed kernel memory.

Because the owning clientid is recorded only after publication, no ownership check can gate access during the vulnerable window. This allows any authenticated NFS client, and potentially unauthenticated network attackers who can guess the identifiers, to trigger the race.

Root Cause

The root cause is improper initialization ordering. nfs4_alloc_init_cpntf_state() publishes the copy-notify entry to globally reachable data structures before nfsd4_copy_notify() records the ownership fields (cp_p_stateid, cp_p_clid) that would enable ownership validation and safe teardown by other code paths.

Attack Vector

An attacker sends an OFFLOAD_CANCEL NFSv4.2 request crafted with cl_id matching the server's nn->s2s_cp_cl_id and a guessable so_id. If timed against a concurrent copy-notify allocation, the cancel path frees the entry mid-initialization. The original request then dereferences freed memory, enabling kernel heap corruption and potential control-flow hijacking over the network.

The vulnerability is described in prose only; no verified public exploit code was available at the time of writing. Refer to the upstream kernel commits referenced in NVD for the exact patched code paths.

Detection Methods for CVE-2026-89669

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nfsd4_copy_notify, manage_cpntf_state, or nfs4_put_cpntf_state in dmesg or /var/log/messages.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free within the nfsd module on hosts where KASAN is enabled.
Anomalous OFFLOAD_CANCEL RPC volume against NFSv4.2 servers, especially from unexpected client addresses.

Detection Strategies

Monitor NFS server hosts for kernel crashes or soft lockups originating in the nfsd copy-offload code paths.
Inspect RPC-level telemetry for OFFLOAD_CANCEL operations paired with COPY_NOTIFY operations from the same or related sources within short time windows.
Correlate kernel logs with network flows to identify potential race exploitation attempts against exposed NFS services.

Monitoring Recommendations

Enable auditd and kernel crash dump collection (kdump) on NFS server hosts to preserve forensic evidence.
Forward kernel and NFS telemetry to a centralized SIEM for correlation with network activity.
Track kernel package versions across the fleet to identify hosts still running vulnerable builds.

How to Mitigate CVE-2026-89669

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD advisory as soon as vendor-rebuilt packages are available.
Restrict network access to NFS server ports (tcp/2049 and related) using host and network firewalls so only trusted clients can reach the service.
Disable NFSv4.2 server-side copy functionality on hosts where it is not required, if the running kernel supports that configuration.

Patch Information

Fixes are available in multiple stable kernel branches. Relevant upstream commits include 129643893b79, 4415a692346a, 4cdef96892f4, 863b6e995665, 9caad13b7cfe, a4d7fedcaaf3, d18d36395d97, and e08a3dcaca05. The patch reorders initialization so cp_p_stateid and cp_p_clid are recorded inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and returns the entry with an extra reference that the caller drops via nfs4_put_cpntf_state(). See the Linux Kernel stable tree commit for the reference implementation.

Workarounds

Limit NFS server exposure to trusted management networks and VPN segments only.
Require Kerberos (sec=krb5) authentication on NFS exports to reduce the pool of clients able to issue crafted RPCs.
Where operationally acceptable, downgrade exports to NFSv4.0 or NFSv4.1 to eliminate the NFSv4.2 copy-offload attack surface.

bash

# Restrict NFS server access via firewalld to a trusted subnet
sudo firewall-cmd --permanent --new-zone=nfs-trusted
sudo firewall-cmd --permanent --zone=nfs-trusted --add-source=10.0.0.0/24
sudo firewall-cmd --permanent --zone=nfs-trusted --add-service=nfs
sudo firewall-cmd --reload

# Verify running kernel version after patching
uname -r