Answer in brief
CVE-2026-89684 records a High severity (CVSS 7.5) vulnerability in nfsd: fix cpntf publish race in nfs4_init_cp_state. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=624322f1adc58acd0b69f77a6ddc764207e97241 <21d6c5957f5ca97d7352e60f55ea412beb9419f5 || >=624322f1adc58acd0b69f77a6ddc764207e97241 <a631a26a8777bb235eabd478bbbaf26a4db750bf || >=624322f1adc58acd0b69f77a6ddc764207e97241 <c7270f62e7a05a2ee68aa2b74262b658a14463bd || >=624322f1adc58acd0b69f77a6ddc764207e97241 <be3a5c1d857b0dcbc11796cea603ef25834f75b2 | 21d6c5957f5ca97d7352e60f55ea412beb9419f5, a631a26a8777bb235eabd478bbbaf26a4db750bf, c7270f62e7a05a2ee68aa2b74262b658a14463bd, be3a5c1d857b0dcbc11796cea603ef25834f75b2 |
| Linux/Linuxgeneric | 5.6 | Not reported |
| Linux/Linuxgeneric | >=624322f1adc58acd0b69f77a6ddc764207e97241 <63e18fc65587fd3f7b4c6d70e96d32fc41d82ba3 || >=624322f1adc58acd0b69f77a6ddc764207e97241 <6ac469a274e3c7d87fc46ba46d83b95009680407 || >=624322f1adc58acd0b69f77a6ddc764207e97241 <8eeca993357a0bc35aaefebfd7462ac7b0a21d9a || >=624322f1adc58acd0b69f77a6ddc764207e97241 <bfeac42d9074e539bacd1898dd8c14b7f5776620 || >=624322f1adc58acd0b69f77a6ddc764207e97241 <21d6c5957f5ca97d7352e60f55ea412beb9419f5 || >=624322f1adc58acd0b69f77a6ddc764207e97241 <a631a26a8777bb235eabd478bbbaf26a4db750bf || >=624322f1adc58acd0b69f77a6ddc764207e97241 <c7270f62e7a05a2ee68aa2b74262b658a14463bd || >=624322f1adc58acd0b69f77a6ddc764207e97241 <be3a5c1d857b0dcbc11796cea603ef25834f75b2 | 63e18fc65587fd3f7b4c6d70e96d32fc41d82ba3, 6ac469a274e3c7d87fc46ba46d83b95009680407, 8eeca993357a0bc35aaefebfd7462ac7b0a21d9a, bfeac42d9074e539bacd1898dd8c14b7f5776620, 21d6c5957f5ca97d7352e60f55ea412beb9419f5, a631a26a8777bb235eabd478bbbaf26a4db750bf, c7270f62e7a05a2ee68aa2b74262b658a14463bd, be3a5c1d857b0dcbc11796cea603ef25834f75b2 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server. Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.
Quoted source text, attributed separately from HOL analysis.