CVE-2026-89669Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already lin…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
— → 7.5
none → high
— → 9.8
none → critical
9.8 → 7.5
critical → high
7.5 → 9.8
high → critical
9.8 → 7
critical → high
0.2% → 0.7%
Last analysed / modified upstream
7 → 9.8
high → critical
In the Linux kernel, the following vulnerability has been resolved:
nfsd: initialize copy-notify stateid before publishing it
nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state() and free the entry, turning the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window.
Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4_put_cpntf_state(); on a late error the laundromat reaps the entry.
Linux >= 624322f1adc58acd0b69f77a6ddc764207e97241 < 863b6e995665472f2af5be2436a874ab6a9e5ac6Linux >= 624322f1adc58acd0b69f77a6ddc764207e97241 < d18d36395d973ef7372c8e6724970585f75b5c0bLinux >= 624322f1adc58acd0b69f77a6ddc764207e97241 < 4415a692346a39fdb647cbd717eda510159aaf55Linux >= 624322f1adc58acd0b69f77a6ddc764207e97241 < 9caad13b7cfe9ccb90cc405ac77335800e086595Linux >= 624322f1adc58acd0b69f77a6ddc764207e97241 < e08a3dcaca0505f861e344a387f37f94d95dbdc2Linux >= 624322f1adc58acd0b69f77a6ddc764207e97241 < a4d7fedcaaf33e60a01e53eafca9041ef966212fLinux >= 624322f1adc58acd0b69f77a6ddc764207e97241 < 4cdef96892f4fa6e70c405b6e8f2fd6972f3b64bLinux >= 624322f1adc58acd0b69f77a6ddc764207e97241 < 129643893b79f8a3c6b72045f933fbab5ee424caLinux 5.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-57804High· 7.3scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
CVE-2024-47794High· 7.8bpf: Prevent tailcall infinite loop caused by freplace
CVE-2025-39977High· 7.8In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() fute…
CVE-2026-100070Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shor…
CVE-2026-100071Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before t…
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing