CVE-2026-89694

A flaw was found in the Linux kernel's NFSv4.2 server (nfsd). An authenticated NFSv4.2 client could exploit a vulnerability in the manage_cpntf_state() function by guessing a state identifier. This improper ownership check allows the client to cancel and free another client's copy-notify stateid, leading to a Denial of Service (DoS) for the legitimate client.

An authorization flaw in nfsd OFFLOAD_CANCEL allowed an authenticated NFSv4.2 client to cancel and free another clients copy notify stateid. The state lookup used a cyclic and guessable so_id, while the embedded clientid was a fixed per net value, so ownership of the copy notify state was not enforced before deletion. For the CVSS the PR:L is used because the attacker must be an authenticated NFSv4.2 client with network access to the NFS server, but does not need administrative privileges on the victim. The issue is network reachable through the NFSv4.2 control path and does not require local code execution on the server. Impact is mainly integrity and availability: an attacker can disrupt another clients server to server copy workflow by invalidating its state, causing operation failure or service degradation for that feature. There is no concrete evidence of kernel memory corruption, information disclosure, or privilege escalation from this patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.