9.8

CVE-2026-89669: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-89669DEBIAN-CVE-2026-89669
Published 11-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-89669 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.69%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 2
MGASA-2026-0506OPENSUSE-SU-2026:11805-1OPENSUSE-SU-2026:22091-1RHSA-2026:77689RHSA-2026:77690

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state() and free the entry, turning the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window. Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4_put_cpntf_state(); on a late error the laundromat reaps the entry.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.69%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

+0.01 pp

From 0.68% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 624322f1adc58acd0b69f77a6ddc764207e97241, < 863b6e995665472f2af5be2436a874ab6a9e5ac6 | ≥ 624322f1adc58acd0b69f77a6ddc764207e97241, < d18d36395d973ef7372c8e6724970585f75b5c0b | ≥ 624322f1adc58acd0b69f77a6ddc764207e97241, < 4415a692346a39fdb647cbd717eda510159aaf55 | ≥ 624322f1adc58acd0b69f77a6ddc764207e97241, < 9caad13b7cfe9ccb90cc405ac77335800e086595 | ≥ 624322f1adc58acd0b69f77a6ddc764207e97241, < e08a3dcaca0505f861e344a387f37f94d95dbdc2 | ≥ 624322f1adc58acd0b69f77a6ddc764207e97241, < a4d7fedcaaf33e60a01e53eafca9041ef966212f | ≥ 624322f1adc58acd0b69f77a6ddc764207e97241, < 4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b | ≥ 624322f1adc58acd0b69f77a6ddc764207e97241, < 129643893b79f8a3c6b72045f933fbab5ee424ca | 5.6

3 vendors · 160 products

References

13 links
Show all 13 references