CVE-2026-89676: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89676 Overview

CVE-2026-89676 is a Linux kernel vulnerability in the NFS server (nfsd) subsystem. The flaw involves a stale Interface Description Register (IDR) entry created during asynchronous server-to-server COPY operations. The function nfsd4_copy() calls nfs4_init_copy_state() before dup_copy_fields(), causing the s2s_cp_stateids IDR to reference &u->copy->cp_stateid in the per-request COMPOUND buffer that is reused by subsequent requests.

Critical Impact
The dangling IDR entry points to reused request memory. Any IDR walker, including the laundromat and manage_cpntf_state(), dereferences attacker-influenced bytes and may call refcount_dec(), idr_remove(), and kfree() on garbage, enabling memory corruption over the network.

Affected Products

Linux kernel builds exposing NFS server functionality with server-to-server COPY support
Distributions shipping vulnerable nfsd code prior to the referenced stable patches
Systems running nfsd with NFSv4.2 inter-server COPY enabled

Discovery Timeline

2026-09-11 - CVE-2026-89676 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89676

Vulnerability Analysis

The vulnerability resides in the nfsd4_copy() function that handles NFSv4.2 asynchronous COPY operations. During an async COPY, nfsd4_copy() invokes nfs4_init_copy_state() before calling dup_copy_fields(). This ordering registers the stateid in the s2s_cp_stateids IDR pointing at &u->copy->cp_stateid, which lives inside the per-rqstp COMPOUND buffer.

The COMPOUND buffer is transient and reused by the next incoming RPC request. dup_copy_fields() only copies the stateid value into async_copy, so the IDR slot continues to reference the ephemeral buffer for the duration of the background copy. Any subsequent NFS request overwrites those bytes.

When an IDR walker traverses the entry, it dereferences reused request memory. The laundromat reads cs_type from the freed region, and if the bytes resemble an expired NFS4_COPYNOTIFY_STID, it proceeds into refcount_dec(), idr_remove(), and kfree() operating on arbitrary data. The manage_cpntf_state() path has the same exposure through idr_find().

Root Cause

The root cause is a use-after-free style condition combined with incorrect initialization ordering. The stateid is registered in the shared IDR before the persistent async_copy structure receives the field values. Registering a pointer to a short-lived stack or buffer object as a long-lived identifier violates the lifetime assumptions of the IDR consumers.

Attack Vector

A remote NFS client can trigger asynchronous COPY operations against a vulnerable server and issue follow-up COMPOUND requests that overwrite the reused buffer with attacker-chosen bytes. When the laundromat or copy notification handler walks the IDR, it operates on those bytes, producing kernel memory corruption reachable over the network without authentication in exposed configurations.

No public proof-of-concept has been released. Exploitation requires the ability to submit NFSv4.2 COPY requests to a reachable nfsd instance. Refer to the kernel security fix commit for the code-level context.

Detection Methods for CVE-2026-89676

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nfsd4_copy, manage_cpntf_state, idr_find, or nfsd4_cb_offload
Slab corruption warnings from refcount_dec() or kfree() in the NFS server code path
Repeated NFSv4.2 inter-server COPY requests followed by malformed COMPOUND traffic from the same client
Unexplained nfsd thread crashes shortly after asynchronous COPY completion callbacks

Detection Strategies

Enable kernel address sanitizer (KASAN) in test environments to surface use-after-free conditions in nfsd
Correlate NFS COPY operation logs with kernel ring buffer entries showing IDR or reference count anomalies
Monitor for NFS clients issuing high volumes of COPY_NOTIFY and COPY operations against a single server
Inspect dmesg for warnings referencing s2s_cp_stateids or the copy laundromat worker

Monitoring Recommendations

Forward kernel logs from all NFS servers into a centralized log store for correlation
Baseline normal inter-server COPY frequency and alert on statistical deviations
Track NFSv4.2 feature usage per client and flag hosts that suddenly begin issuing async COPY workloads
Alert on nfsd service restarts and unexpected kernel taint flags

How to Mitigate CVE-2026-89676

Immediate Actions Required

Apply the upstream kernel patches from the referenced stable commits to all NFS servers
Restrict NFS server exposure to trusted management networks and authenticated clients only
Audit which hosts have NFSv4.2 inter-server COPY enabled and disable it where not required
Prioritize patching servers that accept NFS traffic from untrusted network segments

Patch Information

The fix reorders the operations in nfsd4_copy() so that dup_copy_fields() runs first, then the stateid is registered against the stable async_copy structure rather than the transient COMPOUND buffer. result->cb_stateid is unchanged by the fix. Apply the patches from the primary security fix commit, the follow-up patch update, and the related code enhancement.

Workarounds

Disable NFSv4.2 server-to-server COPY support on affected servers until patching is complete
Block untrusted networks from reaching TCP port 2049 using host or network firewalls
Require Kerberos authentication (sec=krb5) on NFS exports to limit anonymous client access
Isolate NFS servers on dedicated VLANs with strict ingress filtering

bash

# Verify running kernel version and patch level
uname -r

# List active NFS exports and inspect for inter-server COPY usage
exportfs -v

# Restrict NFS access with firewalld to trusted subnets only
firewall-cmd --permanent --zone=internal --add-service=nfs
firewall-cmd --permanent --zone=public --remove-service=nfs
firewall-cmd --reload