PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89676 Linux CVE debrief

A vulnerability in the Linux kernel's nfsd has been resolved, which could lead to a use-after-free condition when handling async COPY operations. This issue arises from nfsd4_copy() calling nfs4_init_copy_state() before dup_copy_fields(), causing the s2s_cp_stateids IDR to point to memory in the per-rqstp COMPOUND buffer that is reused by the next request. The vulnerability exists due to improper handling of async COPY operations, potentially allowing for use-after-free conditions. Linux kernel developers and maintainers should assess exposure and apply patches as necessary to prevent potential use-after-free conditions.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-10-21
Advisory published
2026-09-11
Advisory updated
2026-10-21

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches as necessary. Linux kernel developers and maintainers should assess exposure and apply patches as necessary to prevent potential use-after-free conditions. Additionally, Linux distribution maintainers and users of Linux-based systems should also assess their exposure and apply patches as necessary.

Why it matters

The Linux kernel's nfsd vulnerability could lead to a use-after-free condition when handling async COPY operations, requiring verification of patch application and assessment of exposure.

  • Verify patch application to prevent potential use-after-free conditions.
  • Assess exposure of Linux-based systems to this vulnerability.
  • Monitor system logs for signs of exploitation attempts.

Technical summary

The Linux kernel's nfsd is vulnerable to a use-after-free condition when handling async COPY operations. This occurs because nfsd4_copy() calls nfs4_init_copy_state() before dup_copy_fields(), causing the s2s_cp_stateids IDR to point to memory in the per-rqstp COMPOUND buffer that is reused by the next request. The vulnerability exists in the Linux kernel's nfsd due to improper handling of async COPY operations, leading to a potential use-after-free condition. The issue arises from nfsd4_copy() calling nfs4_init_copy_state() before dup_copy_fields(), causing the s2s_cp_stateids IDR to point to memory in the per-rqstp COMPOUND buffer that is reused by the next request. This could lead to a use-after-free when

Defensive priority

High

Recommended defensive actions

  • Review and apply the provided patches to ensure the nfsd vulnerability is addressed.
  • Monitor Linux kernel updates for any additional patches related to this vulnerability.
  • Verify the integrity of affected systems and assess exposure.
  • Perform a thorough review of system logs to identify potential exploitation attempts.
  • Inventory and track Linux-based systems that may be affected by this vulnerability.
  • Implement compensating controls for exposed systems while remediation is scheduled and verified.
  • Verify patch application to prevent potential use-after-free conditions.

Evidence notes

The vulnerability exists in the Linux kernel's nfsd due to improper handling of async COPY operations, leading to a potential use-after-free condition. The issue arises from nfsd4_copy() calling nfs4_init_copy_state() before dup_copy_fields(), causing the s2s_cp_stateids IDR to point to memory in the per-rqstp COMPOUND buffer that is reused by the next request.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89676 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89676

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89676 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89676

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89676.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bdce362f49410b9def65d76c21f6259cd89696d8

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.