critical 9.8

CVE-2026-89675 in the critical feed json

nfsd: fix UAF in async copy cancel and shutdown

published 2026-09-11 58 d ago modified 2026-10-19 21 d ago also EUVD-2026-76587

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

An async copy could be freed or used after free while a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the copy kthread:

- find_async_copy() bumped copy->refcount but left the copy on clp->async_copies, so the reaper's cleanup_async_copy() could run release_copy_files() concurrently with a cancel/shutdown caller. Both put and NULL nf_src/nf_dst without a common lock, double-putting the nfsd_file and freeing it early.

- nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses of the copy (nfsd_update_cmtime_attr() on copy->nf_dst, nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit as "kthread done, skip kthread_stop()", so a teardown caller ran release_copy_files() -- which puts and NULLs nf_dst -- while the kthread still dereferenced it (NULL/UAF).

- copy->copy_task was never pinned. The one-shot kthread self-reaps on return, so kthread_stop()'s get_task_struct() could touch a freed task_struct.

- co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a reference only on the client, so a concurrent teardown could free the copy while the CB_OFFLOAD callback was in flight.

Fix the teardown lifetime as a whole:

- find_async_copy() unlinks the copy (clear cp_clp, list_del_init) under async_lock; the cancel, shutdown, and sb-cancel paths drop the list-membership reference via nfs4_put_copy() after nfsd4_stop_copy(). Drop the now-redundant list_del fixup from cleanup_async_copy().

- Because unlinking hides the copy from the reaper, its cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids entry; the cancel/shutdown/sb-cancel paths now call nfs4_free_copy_state() themselves (while cp_clp is still valid) so the entry does not dangle at freed memory for the laundromat and manage_cpntf_state() to dereference.

- Give the kthread its own reference, taken in nfsd4_copy() before wake_up_process() and dropped at the end of nfsd4_do_async_copy(); call wake_up_process() before list_add().

- Pin the task_struct with get_task_struct() in nfsd4_copy(), released in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now always kthread_stop()s before release_copy_files(); completion is still reported via NFSD4_COPY_F_COMPLETED, so nfsd4_has_active_async_copies() is unaffected. Each teardown caller removes the copy from clp->async_copies first, so kthread_stop() runs exactly once.

- Take a copy reference in nfsd4_send_cb_offload(), dropped in nfsd4_cb_offload_release(). The kthread still holds its own reference there, so the refcount_inc() cannot race the final free.

- Read cp_clp with smp_load_acquire() to pair with the unordered set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst).

Patch / fix

fixed in 1 distros 6 links 3

Linux Linux 6.18.51, 7.2.4, 7.3

debian ubuntu red hat opensuse almalinux rocky linux

linux Debian 14 7.2.6-1

debian advisories DEBIAN-CVE-2026-89675

linux Ubuntu 26.04 LTS 7.0.0-42.42
linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
linux-ibm Ubuntu 26.04 LTS 7.0.0-1017.17
linux-riscv Ubuntu 26.04 LTS 7.0.0-42.42.1
linux-oracle Ubuntu 26.04 LTS 7.0.0-1015.16
linux-hwe-7.0 Ubuntu 24.04 LTS 7.0.0-42.42~24.04.1
linux-oem-7.0 Ubuntu 26.04 LTS 7.0.0-1017.17

ubuntu advisories UBUNTU-CVE-2026-89675

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 10.2 6.12.0-211.64.1.el10_2
rv RHEL 10.2 6.12.0-211.64.1.el10_2
perf RHEL 10.2 6.12.0-211.64.1.el10_2
rtla RHEL 10.2 6.12.0-211.64.1.el10_2
libperf RHEL 10.2 6.12.0-211.64.1.el10_2
kernel-rt RHEL 10.2 6.12.0-211.64.1.el10_2
kernel-64k RHEL 10.2 6.12.0-211.64.1.el10_2
kernel-core RHEL 10.2 6.12.0-211.64.1.el10_2

red hat advisories RHSA-2026:77690

kernel-source openSUSE Tumbleweed 7.2.6-1.1

opensuse advisories openSUSE-SU-2026:11805-1

kernel AlmaLinux 10 6.12.0-211.64.1.el10_2
rv AlmaLinux 10 6.12.0-211.64.1.el10_2
perf AlmaLinux 10 6.12.0-211.64.1.el10_2
rtla AlmaLinux 10 6.12.0-211.64.1.el10_2
libperf AlmaLinux 10 6.12.0-211.64.1.el10_2
kernel-rt AlmaLinux 10 6.12.0-211.64.1.el10_2
kernel-64k AlmaLinux 10 6.12.0-211.64.1.el10_2
kernel-core AlmaLinux 10 6.12.0-211.64.1.el10_2

almalinux advisories ALSA-2026:77690

kernel Rocky Linux 10 6.12.0-211.64.1.el10_2

rocky linux advisories RLSA-2026:77690

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-89675 updated 2026-11-05 cvss 7.0

kernel: nfsd: fix UAF in async copy cancel and shutdown

Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
affected: workaround, no fix available
Red Hat Enterprise Linux kernel-modules-internal 6.12.0-211.64.1.el10_2 Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.64.1.el10_2, perf 6.12.0-211.64.1.el10_2, rtla 6.12.0-211.64.1.el10_2, python3-perf 6.12.0-211.64.1.el10_2, kernel-devel-matched 6.12.0-211.64.1.el10_2, kernel-64k-devel-matched 6.12.0-211.64.1.el10_2, +7 more Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.64.1.el10_2, kernel-64k 6.12.0-211.64.1.el10_2, kernel-core 6.12.0-211.64.1.el10_2, kernel-tools 6.12.0-211.64.1.el10_2, kernel-modules 6.12.0-211.64.1.el10_2, kernel-64k-core 6.12.0-211.64.1.el10_2, +28 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.64.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.64.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.64.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.64.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.64.1.el10_2 Red Hat Enterprise Linux Hidden (v. 10) kernel-modules-internal 6.12.0-211.64.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.64.1.el10_2 Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.64.1.el10_2, kernel-rt-64k 6.12.0-211.64.1.el10_2, kernel-rt-core 6.12.0-211.64.1.el10_2, kernel-rt-modules 6.12.0-211.64.1.el10_2, kernel-rt-64k-core 6.12.0-211.64.1.el10_2, kernel-rt-debug-core 6.12.0-211.64.1.el10_2, +14 more

+1 more productsfewer

Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.64.1.el10_2, kernel-rt-core 6.12.0-211.64.1.el10_2, kernel-rt-modules 6.12.0-211.64.1.el10_2, kernel-rt-debug-core 6.12.0-211.64.1.el10_2, kernel-rt-modules-core 6.12.0-211.64.1.el10_2, kernel-rt-debug-modules 6.12.0-211.64.1.el10_2, +4 more

fixed: vendor fix RHSA-2026:77690
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 23 d ago (2026-10-16)

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Linux

Classification

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-89675
NVD CVE-2026-89675

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary