CRITICAL Introduced in 4.20
nfsd AsyncCopy UAF
CVE-2026-89676
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dup_copy_fields() copies only the value into async_copy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cs_type from it and, if the bytes look like an expired NFS4_COPYNOTIFY_STID, follows into refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has the same exposure via idr_find(). Duplicate the fields first, then register the stateid on the stable async_copy. result->cb_stateid is unchanged.
02KernelScan AI Analysis
Risk summary
An NFSv4 client can trigger a use-after-free in the NFS server daemon by issuing an async COPY operation. The stale IDR entry points at reused request memory, and subsequent laundromat or state-management walks can dereference garbage, leading to refcount corruption and kfree on attacker-influenced data. This can result in kernel memory corruption, privilege escalation, or denial of service on the NFS server.
Vulnerability analysis
The NFS server handles asynchronous copy requests by creating a background operation. Previously, it registered a pointer to the copy state in a global table while that state still resided in temporary per-request memory that is reused for subsequent client requests. As a result, later server cleanup or state-management code could dereference stale or overwritten memory. If the reused data happened to resemble an expired state type, the server would perform reference-count and memory-free operations on an invalid pointer, corrupting kernel heap state. The fix ensures the state is first duplicated into the stable background object before the global table records it, so the pointer remains valid for the entire copy lifetime. Any authenticated NFSv4 client capable of issuing a copy operation can reach this flaw.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.20 | 6.12.111 | 7aa34ea78f74 |
| 7.2 | 4.20 | 7.2.4 | 14b978e8d05c |
| 6.18 | 4.20 | 6.18.50 | 9b4e5e9ba5ae |
| mainline | 4.20 | 7.3-rc1 | d0beaee498e1 |
| cip/6.12 | 4.20 | 6.12.111-cip32 | 7aa34ea78f74 |