CVE-2026-89684
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix cpntf publish race in nfs4_init_cp_state
nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from
kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server.
Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the Linux kernel's Network File System daemon (nfsd) component represents a critical race condition within the copy state management logic of NFSv4.2 implementations. Specifically, the flaw resides in the nfs4_init_cp_state function where the initialization and publication of a client-to-server copy notification state identifier are not performed atomically. During the allocation and setup of this new cpntf entry, the system publishes the entry into the s2s_cp_stateids IDR with its type set to indicate validity before adding it to the p_stid->sc_cp_list via list_add. This sequence creates a temporal gap where the state identifier is visible to concurrent lookups through so_id, yet the internal linked list pointers remain uninitialized or null due to the kzalloc operation not having completed the full initialization of the list head structure at that precise moment.
This race condition allows for a severe operational impact when an NFSv4.2 client initiates an OFFLOAD_CANCEL request using the state identifier echoed back during the initial setup phase. Because the client can drive this cancellation while the server is still in the middle of initializing the corresponding internal data structures, the kernel attempts to manage the cpntf state through manage_cpntf_state and subsequently _free_cpntf_state_locked. In this scenario, the function attempts to perform a list_del operation on a zeroed or partially initialized list_head structure. This results in memory corruption and an immediate kernel panic or Oops, effectively causing a denial of service against the NFS server by crashing the host system rather than gracefully handling the cancellation request.
From a vulnerability classification perspective, this issue aligns with CWE-362, which describes concurrent execution race conditions that lead to unintended side effects such as data corruption or crashes. The attack vector involves an authenticated remote user sending specific NFSv4.2 protocol messages to trigger the state transition timing window. In terms of adversarial tactics, this corresponds to ATT&CK technique T1499, Endpoint Denial of Service, where the attacker leverages a software flaw to disrupt service availability. The root cause is fundamentally a lack of atomicity in resource publication and linkage within the kernel's locking mechanism, allowing external actors to exploit the window between state visibility and structural integrity.
The resolution involves restructuring the critical sections within nfs4_alloc_init_cpntf_state to ensure that the assignment of cs_type and the insertion into the sc_cp_list occur atomically alongside the idr_alloc_cyclic call. By folding these operations into a single lock section, the kernel guarantees that any concurrent lookup will either fail to find the entry entirely or encounter a fully linked and initialized cp_list structure, thereby eliminating the window for race conditions. Additionally, the initialization sequence is adjusted so that INIT_LIST_HEAD is called immediately after allocation, ensuring list pointers are valid before they can be accessed by other threads.
To further harden the code against potential stale references or double-free scenarios arising from similar patterns elsewhere in the subsystem, the _free_cpntf_state_locked function has been updated to use list_del_init instead of simple list_del. This change ensures that if a stale unlink operation is attempted on an already removed entry, it becomes a no-op rather than corrupting memory by manipulating freed or invalid pointers. Furthermore, nfs4_init_copy_state now passes NULL for p_stid when appropriate, correctly skipping the list_add step to preserve NFS4_COPY_STID semantics and prevent incorrect linkage in contexts where such linking is not required. These changes collectively restore stability and security to the NFSv4.2 copy state management subsystem.