DEBIAN-CVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved:  nfsd: fix UAF in async copy cancel and shutdown  An async copy could be freed or used after free while a teardown caller (OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb) raced the copy kthread:    - findasynccopy() bumped copy->refcount but left the copy on     clp->asynccopies, so the reaper's cleanupasynccopy() could run     releasecopyfiles() concurrently with a cancel/shutdown caller. Both     put and NULL nfsrc/nfdst without a common lock, double-putting the     nfsdfile and freeing it early.    - nfsd4doasynccopy() set NFSD4COPYFSTOPPED before its final uses     of the copy (nfsdupdatecmtimeattr() on copy->nfdst,     nfsd4sendcboffload()). nfsd4stopcopy() treats a set STOPPED bit     as "kthread done, skip kthreadstop()", so a teardown caller ran     releasecopyfiles() -- which puts and NULLs nfdst -- while the     kthread still dereferenced it (NULL/UAF).    - copy->copytask was never pinned. The one-shot kthread self-reaps on     return, so kthreadstop()'s gettaskstruct() could touch a freed     taskstruct.    - cocb is embedded in the copy, but nfsd4sendcboffload() held a     reference only on the client, so a concurrent teardown could free     the copy while the CBOFFLOAD callback was in flight.  Fix the teardown lifetime as a whole:    - findasynccopy() unlinks the copy (clear cpclp, listdelinit)     under asynclock; the cancel, shutdown, and sb-cancel paths drop the     list-membership reference via nfs4putcopy() after nfsd4stopcopy().     Drop the now-redundant listdel fixup from cleanupasynccopy().    - Because unlinking hides the copy from the reaper, its     cleanupasynccopy() can no longer remove the copy's s2scpstateids     entry; the cancel/shutdown/sb-cancel paths now call     nfs4freecopystate() themselves (while cpclp is still valid) so     the entry does not dangle at freed memory for the laundromat and     managecpntfstate() to dereference.    - Give the kthread its own reference, taken in nfsd4copy() before     wakeupprocess() and dropped at the end of nfsd4doasynccopy();     call wakeupprocess() before listadd().    - Pin the taskstruct with gettaskstruct() in nfsd4copy(), released     in nfs4putcopy(), so kthreadstop() is safe whenever the kthread     exits. Set NFSD4COPYFSTOPPED only in nfsd4stopcopy(), which now     always kthreadstop()s before releasecopyfiles(); completion is     still reported via NFSD4COPYFCOMPLETED, so     nfsd4hasactiveasynccopies() is unaffected. Each teardown caller     removes the copy from clp->asynccopies first, so kthreadstop() runs     exactly once.    - Take a copy reference in nfsd4sendcboffload(), dropped in     nfsd4cboffloadrelease(). The kthread still holds its own reference     there, so the refcountinc() cannot race the final free.    - Read cpclp with smploadacquire() to pair with the unordered     setbit()/clearbit() writers (Documentation/atomic_bitops.rst).