CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved:

nfsd: initialize copy-notify stateid before publishing it

nfsd4copynotify() finished initializing the cpntf state after

nfs4allocinitcpntfstate() had already linked it into the

s2scpstateids IDR and the parent's sccplist, with cs_count == 1 (the

membership reference) and none held for the caller. A racing

OFFLOADCANCEL (crafted clid == nn->s2scpcl_id plus the guessable

soid) could reach managecpntf_state() and free the entry, turning the

caller's subsequent cpncnrstateid read and cppstateid/cppclid

writes into use-after-free. The owning clientid was also only recorded

after publication, so it could not gate an ownership check in that window.

Record cppstateid and cppclid inside nfs4allocinitcpntfstate()

before nfs4initcp_state() publishes the entry, and return it with an

extra reference. The caller reads the stateid under that reference and

drops it with nfs4putcpntf_state(); on a late error the laundromat

reaps the entry.