CVE-2026-89669

A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOAD_CANCEL operation, leading to a race condition that frees the state ID prematurely. This could result in a use-after-free, potentially allowing for arbitrary code execution or denial of service.

This vulnerability is rated as Important severity for Red Hat products because an attacker capable of issuing concurrent NFSv4.2 requests to a system hosting exports can trigger kernel memory corruption, potentially causing denial of service or code execution in kernel context. Under typical Red Hat Enterprise Linux installations, the kernel NFS server daemon is not enabled by default, limiting exposure to systems explicitly providing NFS services. Furthermore, successfully triggering the issue requires precise race timing during copy-notify state handling, which reduces the reliability of remote exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.