DEBIAN-CVE-2026-89676

In the Linux kernel, the following vulnerability has been resolved:  nfsd: fix stale s2scpstateids IDR entry for async COPY  For an async COPY, nfsd4copy() called nfs4initcopystate() before dupcopyfields(), so the s2scpstateids IDR was pointed at &u->copy->cpstateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dupcopyfields() copies only the value into asynccopy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cstype from it and, if the bytes look like an expired NFS4COPYNOTIFYSTID, follows into refcountdec()/idrremove()/kfree() on garbage; managecpntfstate() has the same exposure via idrfind().  Duplicate the fields first, then register the stateid on the stable asynccopy. result->cbstateid is unchanged.