From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2ADB658E2BD for ; Fri, 11 Sep 2026 20:01:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156924; cv=none; b=LQOwj11U70NWmsL9FDX/PEhadgB7F4IEGIhNkOFkLRGw0Ufd1gVqCgM3olpqjgv6d9eY+dC1mVNhLbo0H7X972YALUqjxzMV1cxMA0/59Xz0L3LWieOdSfAnxx7pWLiaRhq4rBBFLAhASGjIb7t/UtdV+3WhC8Tem3mgAq8JIhg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156924; c=relaxed/simple; bh=BgD1j4Hf7GyIrMsyJpLkagFj3VECh8DZm8psc4lHr3k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dOh3mUHZrnywyQu/UXTk2yt1BRj9hm3sp8QJQyfSSeHghzlyjjx9zce7XQAgJwTQabrsy7fn62KvdCDteHjZ/nZThQ7P/yaam+MR7LEbAOWiAPTXn/mbuHMPHLX7HYDdTzNcg2fRY2AXpmw+WjEaxMiEpahsqNUcUn0HK6qv3Xk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=C7lV5BWu; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="C7lV5BWu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4BD71F0089A; Fri, 11 Sep 2026 20:01:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156913; bh=7/B+RY+elKwI1FkojDrOtjzHV6L7onO2BSncQmNmat8=; h=From:To:Cc:Subject:Date:Reply-To; b=C7lV5BWu1khMVgxstu0zC9GYQa2j6QV3BTQUgP0VcWEvsEvFk+ixYStaZbDniqtYW n87LQzZ+uWCIM1846aYKEZe+jc9bt6MSweb5SAUaB+Estm5AZtbyk/sKKAC6gRuVg0 qjAi2+JafnE371S6D1ndNDzBMickQXqem6Qh140U= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89675: nfsd: fix UAF in async copy cancel and shutdown Date: Fri, 11 Sep 2026 21:46:04 +0200 Message-ID: <2026091149-CVE-2026-89675-73a4@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4987; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=glWYco/zrkAy25zYXOKmAiAbJPJ5ZD7dUQ3nPsuXgvQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLImtvf70bZnZl+72yk8uOJ23ZsqDT4PrLFG7FmVN2O N3VUkqo7IhhYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJCM1gmPFu37sCMTWhArtX 0THFZYcuv6tfx7Cg+95pA+P160/KfP391O1ipX33xycRAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the copy kthread: - find_async_copy() bumped copy->refcount but left the copy on clp->async_copies, so the reaper's cleanup_async_copy() could run release_copy_files() concurrently with a cancel/shutdown caller. Both put and NULL nf_src/nf_dst without a common lock, double-putting the nfsd_file and freeing it early. - nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses of the copy (nfsd_update_cmtime_attr() on copy->nf_dst, nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit as "kthread done, skip kthread_stop()", so a teardown caller ran release_copy_files() -- which puts and NULLs nf_dst -- while the kthread still dereferenced it (NULL/UAF). - copy->copy_task was never pinned. The one-shot kthread self-reaps on return, so kthread_stop()'s get_task_struct() could touch a freed task_struct. - co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a reference only on the client, so a concurrent teardown could free the copy while the CB_OFFLOAD callback was in flight. Fix the teardown lifetime as a whole: - find_async_copy() unlinks the copy (clear cp_clp, list_del_init) under async_lock; the cancel, shutdown, and sb-cancel paths drop the list-membership reference via nfs4_put_copy() after nfsd4_stop_copy(). Drop the now-redundant list_del fixup from cleanup_async_copy(). - Because unlinking hides the copy from the reaper, its cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids entry; the cancel/shutdown/sb-cancel paths now call nfs4_free_copy_state() themselves (while cp_clp is still valid) so the entry does not dangle at freed memory for the laundromat and manage_cpntf_state() to dereference. - Give the kthread its own reference, taken in nfsd4_copy() before wake_up_process() and dropped at the end of nfsd4_do_async_copy(); call wake_up_process() before list_add(). - Pin the task_struct with get_task_struct() in nfsd4_copy(), released in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now always kthread_stop()s before release_copy_files(); completion is still reported via NFSD4_COPY_F_COMPLETED, so nfsd4_has_active_async_copies() is unaffected. Each teardown caller removes the copy from clp->async_copies first, so kthread_stop() runs exactly once. - Take a copy reference in nfsd4_send_cb_offload(), dropped in nfsd4_cb_offload_release(). The kthread still holds its own reference there, so the refcount_inc() cannot race the final free. - Read cp_clp with smp_load_acquire() to pair with the unordered set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst). The Linux kernel CVE team has assigned CVE-2026-89675 to this issue. Affected and fixed versions =========================== Issue introduced in 4.20 with commit e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 and fixed in 6.18.51 with commit 9031493ef7369d5c59c4bacc96f0c85965f09a98 Issue introduced in 4.20 with commit e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 and fixed in 7.2.4 with commit a385cf5e016b748babf94cc664e43a26e17db117 Issue introduced in 4.20 with commit e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 and fixed in 7.3-rc1 with commit 62c0f6eaf050bb9284c1f9cac6ed1770092e6b95 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89675 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nfsd/nfs4proc.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9031493ef7369d5c59c4bacc96f0c85965f09a98 https://git.kernel.org/stable/c/a385cf5e016b748babf94cc664e43a26e17db117 https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95