CVE-2026-89694 Overview
CVE-2026-89694 affects the Linux kernel's NFS server (nfsd) implementation. The flaw exists in manage_cpntf_state() on the OFFLOAD_CANCEL path, which freed the target copy-notify (cpntf) state without validating client ownership. Any authenticated NFSv4.2 client can cancel and free another client's copy-notify stateid because the lookup key st->si_opaque.so_id is allocated cyclically and thus guessable, while the embedded clientid is a fixed per-net value (nn->s2s_cp_cl_id). The fix compares the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and returns nfserr_bad_stateid on mismatch.
Critical Impact
An authenticated NFSv4.2 client can free copy-notify state belonging to other clients on the same server, disrupting server-side copy operations and enabling cross-tenant interference.
Affected Products
- Linux kernel with NFSv4.2 server-side copy (SSC) support enabled
- Distributions shipping nfsd with the OFFLOAD_CANCEL code path prior to the referenced stable commits
- Multi-tenant NFS environments where more than one authenticated client shares the export namespace
Discovery Timeline
- 2026-09-11 - CVE-2026-89694 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89694
Vulnerability Analysis
The Linux nfsd module implements NFSv4.2 server-side copy using copy-notify stateids that track in-flight inter-server copies. Clients can cancel a pending copy via the OFFLOAD_CANCEL operation, which reaches manage_cpntf_state() with a non-NULL client pointer. On that path, the function looked up the cpntf state by st->si_opaque.so_id and freed the entry without confirming that the requester created it.
Because the so_id value is allocated cyclically, it is predictable across the server's lifetime. The clientid component of the stateid is not per-client either — it is the shared per-net identifier nn->s2s_cp_cl_id used for all server-to-server copy state. As a result, the lookup key does not carry any true ownership information, and cancellation succeeded regardless of which authenticated client issued it.
Root Cause
The root cause is a missing authorization check in the OFFLOAD_CANCEL branch of manage_cpntf_state(). The function trusted the stateid-driven lookup and treated any successful match as a valid cancellation request. Ownership metadata existed in state->cp_p_clid, but that field was never compared against the calling client's cl_clientid before the entry was released.
Attack Vector
Exploitation requires an authenticated NFSv4.2 session against a vulnerable server that has server-side copy enabled. An attacker guesses or enumerates the cyclic so_id and issues OFFLOAD_CANCEL with a crafted copy-notify stateid. The server frees the target entry, invalidating another tenant's pending copy operation and forcing the victim's transfer to fail. Repeated abuse can systematically disrupt copy workloads across the entire server.
The upstream patch adds a comparison between state->cp_p_clid and the requesting client's cl_clientid, returning nfserr_bad_stateid when they diverge instead of freeing the state. Refer to the kernel commit b1eca07 and related stable backports for the exact code change.
Detection Methods for CVE-2026-89694
Indicators of Compromise
- Unexpected NFS4ERR_BAD_STATEID responses returned to NFSv4.2 clients that did not initiate an OFFLOAD_CANCEL.
- Server-side copy operations aborting or failing mid-transfer without corresponding client-side cancellation requests.
- NFSv4.2 clients issuing OFFLOAD_CANCEL operations with stateids they did not receive from a prior COPY_NOTIFY.
Detection Strategies
- Enable nfsd tracepoints such as nfsd_cb_offload and stateid lifecycle events to correlate OFFLOAD_CANCEL requests with the originating client.
- Audit NFSv4.2 RPC traffic to identify clients invoking OFFLOAD_CANCEL against stateids created by other principals.
- Compare kernel package versions against the fixed stable commits listed in the NVD references to determine exposure.
Monitoring Recommendations
- Collect and centralize nfsd kernel logs and RPC audit records into a security data lake for cross-client correlation.
- Alert when a single authenticated NFS principal issues a high volume of OFFLOAD_CANCEL operations or triggers repeated NFS4ERR_BAD_STATEID returns.
- Monitor NFS server health metrics for spikes in aborted copy operations that do not map to client-reported cancellations.
How to Mitigate CVE-2026-89694
Immediate Actions Required
- Update to a Linux kernel that includes the ownership-check fix for manage_cpntf_state() on the OFFLOAD_CANCEL path.
- Inventory NFS servers that expose NFSv4.2 with server-side copy enabled and prioritize patching multi-tenant systems.
- Restrict which client networks can authenticate to affected NFS servers until the patch is applied.
Patch Information
The fix is available in the following mainline and stable kernel commits: 6bba72b, 6bdbfab, 75268f6, 81b2cfe, 88daaed, b1eca07, b42dc26, and d801906. Apply the vendor-provided kernel update matching your distribution's supported stable branch.
Workarounds
- Disable NFSv4.2 server-side copy where operationally feasible until the kernel patch is deployed.
- Limit NFS export access to trusted, single-tenant client populations to reduce cross-client abuse potential.
- Enforce strong Kerberos (krb5, krb5i, krb5p) authentication on NFSv4.2 exports to constrain who can issue OFFLOAD_CANCEL.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.