HIGH Introduced in 5.6
nfsd CpntfState Race
CVE-2026-89684
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server. Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.
02KernelScan AI Analysis
Risk summary
A race condition in the Linux NFS server's COPY_NOTIFY state handling allows any NFSv4.2 client to crash the server by sending an OFFLOAD_CANCEL that races with state entry creation. The resulting NULL pointer dereference oopses the kernel, causing denial of service. Any device running an NFS server accessible to NFSv4.2 clients is at risk.
Vulnerability analysis
When the NFS server creates a copy-notify state entry for an NFSv4.2 COPY_NOTIFY operation, it makes the entry visible to lookups before fully linking it into its associated list. During the brief window before the link completes, the entry is reachable but its list pointers are still zeroed from allocation. A concurrent OFFLOAD_CANCEL request — which any NFSv4.2 client can issue using the stateid returned by COPY_NOTIFY — finds the half-initialized entry and attempts to remove it, dereferencing the zeroed list pointers and crashing the server kernel. The fix ensures the entry is fully linked before it becomes visible to lookups, so a concurrent operation either finds nothing or a completely initialized entry. The removal path is also hardened to tolerate taking down an entry that was never fully linked. Any NFSv4.2 client with network access to the server can trigger this by issuing COPY_NOTIFY and immediately racing an OFFLOAD_CANCEL with the returned stateid; no special client privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.6 | 6.12.109 | 21d6c5957f5c |
| 5.10 | 5.6 | 5.10.270 | 63e18fc65587 |
| 5.15 | 5.6 | 5.15.221 | 6ac469a274e3 |
| 6.18 | 5.6 | 6.18.50 | a631a26a8777 |
| mainline | 5.6 | 7.3-rc1 | be3a5c1d857b |
| 6.6 | 5.6 | 6.6.157 | bfeac42d9074 |
| 6.1 | 5.6 | 6.1.188 | 8eeca993357a |
| 7.2 | 5.6 | 7.2.4 | c7270f62e7a0 |
| cip/6.12 | 5.6 | 6.12.111-cip32 | 21d6c5957f5c |