CVE-2026-89684

A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOAD_CANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a denial of service (DoS) by causing the server to crash.

A server side race in NFSD COPY_NOTIFY state publication can make a new cpntf state reachable through the s2s_cp_stateids IDR before its cp_list entry is fully linked. A racing NFSv4.2 client can use the echoed cnr_stateid in OFFLOAD_CANCEL to reach manage_cpntf_state and free the partially published object, which can cause list_del on an uninitialized list_head, a kernel oops, and a server DoS. The same publish before link pattern is a use-after-free candidate because the allocation path may continue after the racing cancel has dropped the last reference and freed the cpntf object. For the CVSS the PR:L is used for the paranoid score because the attacker generally needs access as an NFSv4.2 client able to drive COPY_NOTIFY and OFFLOAD_CANCEL, but does not need local privileges on the server. The issue is network reachable through the NFS server control path and is most relevant on internal storage or data center networks where NFSv4.2 server side copy features are exposed. Impact is at least remote denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to a race based use-after-free candidate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.