« Volver al listado

CVE-2026-89694

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check client ownership when cancelling a copy-notify stateid

On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st->si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid.

Compare the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89694",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ce0887ac96d35c7105090e166bb0807dc0a0e838",
              "lessThan": "88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce0887ac96d35c7105090e166bb0807dc0a0e838",
              "lessThan": "81b2cfe767943922eca906a2a5af23a0ce5d0f35",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce0887ac96d35c7105090e166bb0807dc0a0e838",
              "lessThan": "6bba72b8ee68ad631b94bd439592cba46de54d7d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce0887ac96d35c7105090e166bb0807dc0a0e838",
              "lessThan": "75268f6cfe26b09a7e4d3216367e87fe9e2a26aa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce0887ac96d35c7105090e166bb0807dc0a0e838",
              "lessThan": "b1eca07303594ca27f5dc360a6946bd7e1f5b04c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce0887ac96d35c7105090e166bb0807dc0a0e838",
              "lessThan": "b42dc26a14b4ad5d6daaada11ec4c70744141c25",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce0887ac96d35c7105090e166bb0807dc0a0e838",
              "lessThan": "d801906165cb5cc250d5cbe44935594e170be3e2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce0887ac96d35c7105090e166bb0807dc0a0e838",
              "lessThan": "6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:56.490",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/6bba72b8ee68ad631b94bd439592cba46de54d7d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/75268f6cfe26b09a7e4d3216367e87fe9e2a26aa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/81b2cfe767943922eca906a2a5af23a0ce5d0f35",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1eca07303594ca27f5dc360a6946bd7e1f5b04c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b42dc26a14b4ad5d6daaada11ec4c70744141c25",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d801906165cb5cc250d5cbe44935594e170be3e2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: check client ownership when cancelling a copy-notify stateid\n\nOn the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the\ntarget cpntf state without checking ownership. The lookup key\nst->si_opaque.so_id is allocated cyclically (guessable) and the embedded\nclientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated\nNFSv4.2 client could cancel and free another client's copy-notify\nstateid.\n\nCompare the creating clientid recorded in state->cp_p_clid against the\nrequesting client's cl_clientid and return nfserr_bad_stateid on a\nmismatch instead of freeing the entry."
    }
  ],
  "lastModified": "2026-09-14T13:19:19.767",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}