{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-89663", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-89663", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-09-11T19:45:50.577Z", "updatedAt": "2026-10-19T08:50:34.792Z", "importedAt": "2026-10-24T01:58:35.090Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "nfsd: revoke copy-notify stateids before dropping their reference", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: revoke copy-notify stateids before dropping their reference\n\nCopy-notify stateids live in the s2s_cp_stateids IDR and on their parent\nstid's sc_cp_list, pinned by a single membership reference.\n_free_cpntf_state_locked() only unlinks an entry once its refcount reaches\nzero, so any revoke path that runs while a concurrent\nfind_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops\nthe reference without unlinking, leaving the entry discoverable with its\nmembership reference already consumed. A second revoke or a laundromat tick\nthen frees it while the reader still holds the pointer -- a\nKASAN-detectable use-after-free at the reader's nfs4_put_cpntf_state().\n\nThis affected all three revoke paths:\n\n - The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called\n _free_cpntf_state_locked() on the first list entry; a holder that had\n bumped cs_count made it return early, so the next iteration\n re-decremented and burned the holder's reference.\n\n - OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise\n used _free_cpntf_state_locked() and could drop 2->1 without unlinking.\n\nAdd revoke_cpntf_state_locked(), which unhashes the entry from the IDR and\nsc_cp_list first (deferring the final free to any holder), and use it from\nall three revoke paths. The drain now walks with list_for_each_entry_safe()\nand revokes each entry unconditionally, so it terminates in one pass per\nentry regardless of cs_count. The unhash is gated on\n!list_empty(&cps->cp_list); the idr_remove() gate matters because\nidr_alloc_cyclic() may have recycled the so_id by then. Keep\n_free_cpntf_state_locked() for the reference-holder put path only, where a\nconcurrent revoke may already have unlinked the entry (its list_del_init()\nthen a no-op).", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "624322f1adc58acd0b69f77a6ddc764207e97241", "status": "affected", "versionType": "git", "lessThan": "5f00e0ab4de45d4f9e4bd0883cf2517acf63fc0d" }, { "version": "624322f1adc58acd0b69f77a6ddc764207e97241", "status": "affected", "versionType": "git", "lessThan": "06a62f6dbc60791f4229c6950b1eec6b18df9af1" }, { "version": "624322f1adc58acd0b69f77a6ddc764207e97241", "status": "affected", "versionType": "git", "lessThan": "a1fca0f7bbb7b100a39c7ba8dd7922c87c4237a3" }, { "version": "624322f1adc58acd0b69f77a6ddc764207e97241", "status": "affected", "versionType": "git", "lessThan": "caddbeffab1eaba1d2bcf5ceda35547863466705" }, { "version": "624322f1adc58acd0b69f77a6ddc764207e97241", "status": "affected", "versionType": "git", "lessThan": "6b8149448cdcb476fba4559d1ecc247efee9971b" }, { "version": "624322f1adc58acd0b69f77a6ddc764207e97241", "status": "affected", "versionType": "git", "lessThan": "b56d2c5f01cddbeca7d11cce81d97db4ec9a464f" }, { "version": "624322f1adc58acd0b69f77a6ddc764207e97241", "status": "affected", "versionType": "git", "lessThan": "ff8a3cff02b92b2a82f1a9876038fcf953ae9c25" }, { "version": "624322f1adc58acd0b69f77a6ddc764207e97241", "status": "affected", "versionType": "git", "lessThan": "3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "5.6", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "5.6" }, { "version": "5.10.270", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.221", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.188", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.157", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.109", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.50", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.2.4", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.2.*" }, { "version": "7.3", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }