CVE-2026-89684: Linux Kernel Race Condition Vulnerability

CVE-2026-89684 Overview

CVE-2026-89684 is a race condition in the Linux kernel's NFS server (nfsd) subsystem. The flaw exists in nfs4_alloc_init_cpntf_state(), which publishes a new copy-notify (cpntf) entry into the s2s_cp_stateids IDR before linking it onto p_stid->sc_cp_list. During the window between these two operations, the entry is reachable by so_id while its cp_list remains zeroed from kzalloc. A concurrent OFFLOAD_CANCEL request from any NFSv4.2 client can trigger manage_cpntf_state() and _free_cpntf_state_locked(), which calls list_del() on the uninitialized list head. The result is a kernel oops that crashes the NFS server.

Critical Impact
Any authenticated NFSv4.2 client can remotely crash the NFS server by exploiting the race between cpntf state publication and list linkage.

Affected Products

Linux kernel nfsd subsystem (NFSv4.2 server-side copy)
Distributions shipping affected kernel versions with nfsd enabled
Systems exposing NFSv4.2 with server-side copy support

Discovery Timeline

2026-09-11 - CVE-2026-89684 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89684

Vulnerability Analysis

The vulnerability resides in the NFS server implementation of server-to-server copy (cpntf) state management. The function nfs4_alloc_init_cpntf_state() executes two distinct critical sections under s2s_cp_lock. In the first section it allocates the state entry via idr_alloc_cyclic() and sets cs_type, making the entry discoverable by its so_id. In the second section it appends the entry to p_stid->sc_cp_list using list_add().

Between these two locked sections, the entry's cp_listnext and prev pointers remain NULL from the initial kzalloc. Because NFSv4.2 echoes the so_id back to the client as cnr_stateid, any authenticated client can reference the entry during this window. An attacker who sends a well-timed OFFLOAD_CANCEL operation triggers _free_cpntf_state_locked(), which invokes list_del() on the zeroed list_head. Dereferencing the null pointers causes a kernel oops.

Root Cause

The root cause is improper synchronization between object publication and object initialization. The cpntf entry becomes reachable by lookup before all of its fields are fully initialized, violating the invariant that a discoverable object must be structurally complete. This is a classic Time-of-Check Time-of-Use (TOCTOU) pattern applied to intrusive kernel data structures.

Attack Vector

Exploitation requires network access to an NFSv4.2 server with server-side copy enabled. Any client capable of initiating a COPY operation can receive a cnr_stateid referencing the vulnerable entry. The attacker then issues OFFLOAD_CANCEL requests targeting that stateid to race the incomplete publication window. Successful exploitation produces a kernel oops, resulting in denial of service for the NFS server and any workloads depending on it.

See the upstream fix in Linux Kernel Commit 21d6c59 for the corrected locking pattern.

Detection Methods for CVE-2026-89684

Indicators of Compromise

Unexpected NFS server kernel oops referencing _free_cpntf_state_locked or list_del in stack traces
Repeated NFSv4.2 OFFLOAD_CANCEL operations from a single client shortly after COPY requests
NFS service crashes or restarts correlated with NFSv4.2 client activity
dmesg entries showing null pointer dereferences within nfsd code paths

Detection Strategies

Monitor kernel logs for oops events with nfsd, manage_cpntf_state, or nfs4_init_cp_state in the call trace
Correlate NFS protocol traffic captures to identify bursts of OFFLOAD_CANCEL operations against active copy stateids
Track NFS service uptime and unexpected restarts on servers with server-side copy enabled

Monitoring Recommendations

Enable kernel crash dump collection (kdump) on NFS servers to capture forensic evidence of oopses
Ingest /var/log/messages and journalctl output into a centralized log platform for pattern analysis
Alert on NFSv4.2 clients issuing high-frequency copy and cancel sequences from a single source

How to Mitigate CVE-2026-89684

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor-backported kernels are available
Restrict NFSv4.2 server access to trusted client networks using firewall rules or exports host constraints
Disable NFSv4.2 server-side copy if it is not required by the environment
Prepare NFS server failover or restart procedures to minimize downtime from potential crashes

Patch Information

The fix folds the cs_type assignment and the list_add() call into the same critical section as idr_alloc_cyclic(). This ensures a concurrent lookup either misses the entry entirely or observes a fully linked cp_list. The patch also calls INIT_LIST_HEAD() on the entry after allocation and converts _free_cpntf_state_locked() to use list_del_init(), so any stale unlink becomes a no-op. Reference commits include Linux Kernel Commit 63e18fc, Linux Kernel Commit 6ac469a, Linux Kernel Commit 8eeca99, Linux Kernel Commit a631a26, Linux Kernel Commit be3a5c1, Linux Kernel Commit bfeac42, and Linux Kernel Commit c7270f62.

Workarounds

Limit NFSv4.2 exports to trusted clients via /etc/exports host restrictions
Block NFS protocol ports (TCP/2049) at the perimeter for untrusted networks
Disable server-side copy by mounting only NFSv4.0 or NFSv4.1 where feasible
Segment NFS servers onto isolated networks to reduce the attacker population

bash

# Restrict NFS exports to a trusted subnet in /etc/exports
/srv/nfs  10.0.0.0/24(rw,sync,no_subtree_check)

# Reload exports after modification
exportfs -ra

# Optionally block NFS from untrusted networks
iptables -A INPUT -p tcp --dport 2049 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP