nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-89684

nfsd: fix cpntf publish race in nfs4_init_cp_state

Answer in brief

CVE-2026-89684 records a Unknown severity vulnerability in nfsd: fix cpntf publish race in nfs4_init_cp_state. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 11, 2026Updated Sep 11, 2026Source checked Sep 11, 2026First seen by HOL Sep 11, 2026Material review Sep 11, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=624322f1adc58acd0b69f77a6ddc764207e97241 <21d6c5957f5ca97d7352e60f55ea412beb9419f5 \|\| >=624322f1adc58acd0b69f77a6ddc764207e97241 <a631a26a8777bb235eabd478bbbaf26a4db750bf \|\| >=624322f1adc58acd0b69f77a6ddc764207e97241 <c7270f62e7a05a2ee68aa2b74262b658a14463bd \|\| >=624322f1adc58acd0b69f77a6ddc764207e97241 <be3a5c1d857b0dcbc11796cea603ef25834f75b2	21d6c5957f5ca97d7352e60f55ea412beb9419f5, a631a26a8777bb235eabd478bbbaf26a4db750bf, c7270f62e7a05a2ee68aa2b74262b658a14463bd, be3a5c1d857b0dcbc11796cea603ef25834f75b2
Linux/Linuxgeneric	5.6	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 21d6c5957f5ca97d7352e60f55ea412beb9419f5 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server. Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.

Quoted source text, attributed separately from HOL analysis.