CVE-2026-89669 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should prioritize patching vulnerable Linux kernel versions and verify version information. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

A use-after-free vulnerability in the Linux kernel's nfsd subsystem could allow for potential code execution or denial of service attacks. Defenders should prioritize patching vulnerable Linux kernel versions and verify version information.

• Potential use-after-free attacks may allow for arbitrary code execution or denial of service
• Successful exploitation requires network access and a crafted OFFLOAD_CANCEL operation
• Defenders should prioritize patching vulnerable Linux kernel versions
• Verification of Linux kernel versions and patch application is necessary

Technical summary

The vulnerability exists in the Linux kernel's nfsd subsystem, specifically in the nfsd4_copy_notify() function. The function publishes a copy-notify stateid before fully initializing it, allowing a racing OFFLOAD_CANCEL operation to free the entry and cause a use-after-free when the caller attempts to access the stateid. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window. Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference.

Defensive priority

High

Recommended defensive actions

• Review and apply the Linux kernel patches to address the vulnerability
• Monitor Linux kernel versions for updates and apply patches as needed
• Consider implementing compensating controls to mitigate potential impacts
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. Linux kernel developers have addressed the issue through a series of commits. The vulnerability has been resolved in the Linux kernel. Defenders should verify Linux kernel versions and apply patches as needed. The CVE record was published on 2026-09-11T19:45:55.111Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.