CVE-2026-89675: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89675 Overview

CVE-2026-89675 is a use-after-free (UAF) vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the async copy teardown path, where callers such as OFFLOAD_CANCEL, nfsd4_shutdown_copy, and nfsd4_cancel_copy_by_sb can race the copy kthread. The race allows concurrent access to nf_src and nf_dst file references, leading to double-put operations and premature freeing of nfsd_file structures. An unauthenticated remote NFS client interacting with a vulnerable server can trigger the condition through legitimate NFSv4.2 server-side copy operations.

Critical Impact
Remote attackers with NFS access can trigger memory corruption in kernel space, potentially leading to denial of service or arbitrary code execution in kernel context.

Affected Products

Linux kernel versions containing the async copy implementation in fs/nfsd/nfs4proc.c
Systems running nfsd with NFSv4.2 server-side copy (SSC) enabled
Distributions shipping kernels prior to the fixing commits 62c0f6e, 9031493, and a385cf5

Discovery Timeline

2026-09-11 - CVE-2026-89675 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89675

Vulnerability Analysis

The vulnerability affects the NFSv4.2 server-side copy offload machinery in nfsd. When a client issues an asynchronous COPY operation, nfsd spawns a kthread to perform the copy and tracks it via a struct nfsd4_copy entry on the client's async_copies list. Teardown callers can race the copy worker in several distinct ways.

First, find_async_copy() increments copy->refcount but leaves the copy on clp->async_copies. The reaper's cleanup_async_copy() can therefore run release_copy_files() concurrently with a cancel or shutdown caller. Both paths put and NULL nf_src and nf_dst without a shared lock, producing a double-put on the underlying nfsd_file.

Second, nfsd4_do_async_copy() sets NFSD4_COPY_F_STOPPED before its final uses of the copy. Because nfsd4_stop_copy() treats a set STOPPED bit as "kthread done, skip kthread_stop()", a teardown caller can invoke release_copy_files() and NULL nf_dst while the kthread still dereferences it.

Third, copy->copy_task was never pinned. The one-shot kthread self-reaps on return, so kthread_stop()'s get_task_struct() can touch a freed task_struct. Finally, co_cb is embedded in the copy, but nfsd4_send_cb_offload() only referenced the client, allowing concurrent teardown to free the copy while the CB_OFFLOAD callback was in flight.

Root Cause

The root cause is inconsistent lifetime management of struct nfsd4_copy and its embedded resources across the kthread, reaper, and teardown paths. Reference counting was applied unevenly, list membership was not used to gate visibility to the reaper, and ordering assumptions around NFSD4_COPY_F_STOPPED conflated "kthread finished" with "safe to free copy resources."

Attack Vector

An authenticated NFSv4.2 client can issue asynchronous COPY operations followed by OFFLOAD_CANCEL requests to induce the race. Server-side triggers such as filesystem unmount (nfsd4_cancel_copy_by_sb) or service shutdown (nfsd4_shutdown_copy) can also drive the same window. Successful exploitation corrupts kernel memory, allowing denial of service and, in principle, further escalation.

// No public proof-of-concept code has been published for this issue.
// See the upstream commits referenced below for the exact code paths
// and the reordering of reference-count and list operations that close
// the race window.

Detection Methods for CVE-2026-89675

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nfsd4_do_async_copy, release_copy_files, cleanup_async_copy, or nfsd4_send_cb_offload
KASAN reports indicating use-after-free on struct nfsd4_copy or nfsd_file objects during NFS COPY or OFFLOAD_CANCEL handling
NFS server crashes correlated with high volumes of client-initiated OFFLOAD_CANCEL operations

Detection Strategies

Enable KASAN on test kernels to surface UAF conditions in nfsd copy paths during fuzzing or QA runs
Monitor kernel ring buffer output (dmesg) for nfsd-tagged warnings, BUG reports, and general protection faults
Correlate NFSv4.2 COPY operation logs with server stability events to identify abuse patterns

Monitoring Recommendations

Track NFS server uptime, crash frequency, and kernel logs through centralized log aggregation
Alert on unusual rates of OFFLOAD_CANCEL operations from single clients
Baseline expected server-side copy workloads and flag anomalous concurrent COPY and cancel sequences

How to Mitigate CVE-2026-89675

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 62c0f6e, 9031493, and a385cf5
Rebuild and deploy kernels from distribution vendors once patched packages are published
Restrict NFS server exposure to trusted network segments until patched builds are available

Patch Information

The fix restructures async copy teardown lifetime. find_async_copy() now unlinks the copy under async_lock by clearing cp_clp and calling list_del_init. Cancel, shutdown, and sb-cancel paths drop the list-membership reference via nfs4_put_copy() after nfsd4_stop_copy(). The kthread receives its own reference taken in nfsd4_copy() before wake_up_process(), copy_task is pinned with get_task_struct(), and nfsd4_send_cb_offload() now takes a copy reference dropped in nfsd4_cb_offload_release(). Reads of cp_clp use smp_load_acquire() to pair with the set_bit()/clear_bit() writers.

Workarounds

Disable NFSv4.2 server-side copy support if the workload does not require it
Limit NFS export access to authenticated, trusted clients using strong network segmentation
Consider firewalling NFS ports from untrusted networks until patches are applied

bash

# Verify running kernel version and check for updates
uname -r

# On Debian/Ubuntu systems
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)

# On RHEL/CentOS/Fedora systems
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot