In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY,… (CVE-2026-89676)
A vulnerability in the Linux kernel's NFS server (nfsd) involving stale s2s_cp_stateids IDR entries for asynchronous COPY operations has been resolved. The issue was due to the IDR pointing to transient memory reused by subsequent requests, leading to potential use-after-free conditions when IDR walkers dereferenced this stale memory. The fix involved duplicating fields before registering the stateid on a stable async_copy structure to prevent dangling pointers.
AI Analysis
Technical Summary
The Linux kernel's NFS server (nfsd) had a vulnerability where the s2s_cp_stateids IDR entry for async COPY operations pointed to memory in a per-request COMPOUND buffer that was reused by subsequent requests. This caused the IDR slot to dangle at transient memory, which could be dereferenced by IDR walkers, potentially leading to use-after-free scenarios involving refcount decrement and memory free operations. The fix was to duplicate the relevant fields before registering the stateid on a stable async_copy structure, ensuring the IDR entry references stable memory.
Potential Impact
The vulnerability could lead to use-after-free conditions in the kernel memory management due to stale IDR entries referencing transient request memory. This may cause kernel crashes or memory corruption. No specific exploit or active exploitation is reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by changing the order of operations to duplicate fields before registering the stateid. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly stated in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY,… (CVE-2026-89676)
Description
A vulnerability in the Linux kernel's NFS server (nfsd) involving stale s2s_cp_stateids IDR entries for asynchronous COPY operations has been resolved. The issue was due to the IDR pointing to transient memory reused by subsequent requests, leading to potential use-after-free conditions when IDR walkers dereferenced this stale memory. The fix involved duplicating fields before registering the stateid on a stable async_copy structure to prevent dangling pointers.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's NFS server (nfsd) had a vulnerability where the s2s_cp_stateids IDR entry for async COPY operations pointed to memory in a per-request COMPOUND buffer that was reused by subsequent requests. This caused the IDR slot to dangle at transient memory, which could be dereferenced by IDR walkers, potentially leading to use-after-free scenarios involving refcount decrement and memory free operations. The fix was to duplicate the relevant fields before registering the stateid on a stable async_copy structure, ensuring the IDR entry references stable memory.
Potential Impact
The vulnerability could lead to use-after-free conditions in the kernel memory management due to stale IDR entries referencing transient request memory. This may cause kernel crashes or memory corruption. No specific exploit or active exploitation is reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by changing the order of operations to duplicate fields before registering the stateid. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly stated in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gwc7-hc26-hx5g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89676"]
Threat ID: 6aa4a00255bf5e2cf5a86612
Added to database: 09/12/2026, 00:42:42 UTC
Last enriched: 09/12/2026, 00:55:18 UTC
Last updated: 09/12/2026, 00:55:48 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.