From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 60CF14570D0 for ; Fri, 11 Sep 2026 20:02:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156958; cv=none; b=Pbr6CYnISfYHVrIbGbKJIDprfobnsm+asBwq0blJcuOTm5WT1vzKCHnseiBeuCX5ma8m2accThOAoqJzTdEWN8lU+y05K82v778QTkYGvR0W1mOJDuMXa94rjc4aYmLK4pjVLuT4LH6YHIgQP9jO5xadNzg2yy2SHnEMItN6Gbg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156958; c=relaxed/simple; bh=xUJfY/MOf0rpbutlp8/T9lyiPJeIHPibpWtuolmDox8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iocVLoMeHoybVHbSO5EBT2lm1SUvhsG8A51sGHXsoSq5ujO/f8aa5tTOExy+O5mZANU0wSBLBNFIW4cBRFKbnkyPCYs5zqQIRb8XJWJzr2GZMOUF42gLCExWhs/OLzOlbEpqd1TGCHVZZv1lKHMOVsTH9kzzsg1wp41KFr5+ztM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Kumxut36; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Kumxut36" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5184D1F000FF; Fri, 11 Sep 2026 20:02:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156942; bh=iFlvcD9PlmskgjEEGBV+hpFGW1gnT1zz0dlUsbMc15E=; h=From:To:Cc:Subject:Date:Reply-To; b=Kumxut36TQqwqMtoXJ8kR1V1vk3nRM/KRgEPAd61ZHRlnk3Ndcr0rzL62CY5xEGEv hldrNcLQ8WG9fVVgiyiWKN/e6ScYxUnVEO9knFqKiC9VBG5Y5VfI3aom9JMIlPUorC bYPA6K7JfwBZrZQavg1CCO57EepBca6vDQ3k7bEo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state Date: Fri, 11 Sep 2026 21:46:13 +0200 Message-ID: <2026091151-CVE-2026-89684-6090@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3162; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=W7rllmyTFZ9FqtBIyEAB2zUan9hx3JJdR4LqcWxhw5k=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIuvfZSqtClVqP7qm4SAXt/W8Qp9V5zPuH9fkjFyU7 LbMtaioI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACYS5c8wT2mN5f3Y5IDpPdfW 9fIZnzLgW19ZyDA/28avu/Dm04QJMmpVSoqyi7i6HQ8DAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server. Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics. The Linux kernel CVE team has assigned CVE-2026-89684 to this issue. Affected and fixed versions =========================== Issue introduced in 5.6 with commit 624322f1adc58acd0b69f77a6ddc764207e97241 and fixed in 6.12.109 with commit 21d6c5957f5ca97d7352e60f55ea412beb9419f5 Issue introduced in 5.6 with commit 624322f1adc58acd0b69f77a6ddc764207e97241 and fixed in 6.18.50 with commit a631a26a8777bb235eabd478bbbaf26a4db750bf Issue introduced in 5.6 with commit 624322f1adc58acd0b69f77a6ddc764207e97241 and fixed in 7.2.4 with commit c7270f62e7a05a2ee68aa2b74262b658a14463bd Issue introduced in 5.6 with commit 624322f1adc58acd0b69f77a6ddc764207e97241 and fixed in 7.3-rc1 with commit be3a5c1d857b0dcbc11796cea603ef25834f75b2 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89684 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nfsd/nfs4state.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/21d6c5957f5ca97d7352e60f55ea412beb9419f5 https://git.kernel.org/stable/c/a631a26a8777bb235eabd478bbbaf26a4db750bf https://git.kernel.org/stable/c/c7270f62e7a05a2ee68aa2b74262b658a14463bd https://git.kernel.org/stable/c/be3a5c1d857b0dcbc11796cea603ef25834f75b2