{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "624322f1adc58acd0b69f77a6ddc764207e97241"
            },
            {
              "fixed": "5f00e0ab4de45d4f9e4bd0883cf2517acf63fc0d"
            },
            {
              "fixed": "06a62f6dbc60791f4229c6950b1eec6b18df9af1"
            },
            {
              "fixed": "a1fca0f7bbb7b100a39c7ba8dd7922c87c4237a3"
            },
            {
              "fixed": "caddbeffab1eaba1d2bcf5ceda35547863466705"
            },
            {
              "fixed": "6b8149448cdcb476fba4559d1ecc247efee9971b"
            },
            {
              "fixed": "b56d2c5f01cddbeca7d11cce81d97db4ec9a464f"
            },
            {
              "fixed": "ff8a3cff02b92b2a82f1a9876038fcf953ae9c25"
            },
            {
              "fixed": "3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.6.0"
            },
            {
              "fixed": "5.10.270"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.221"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.188"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89663.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: revoke copy-notify stateids before dropping their reference\n\nCopy-notify stateids live in the s2s_cp_stateids IDR and on their parent\nstid's sc_cp_list, pinned by a single membership reference.\n_free_cpntf_state_locked() only unlinks an entry once its refcount reaches\nzero, so any revoke path that runs while a concurrent\nfind_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops\nthe reference without unlinking, leaving the entry discoverable with its\nmembership reference already consumed. A second revoke or a laundromat tick\nthen frees it while the reader still holds the pointer -- a\nKASAN-detectable use-after-free at the reader's nfs4_put_cpntf_state().\n\nThis affected all three revoke paths:\n\n  - The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called\n    _free_cpntf_state_locked() on the first list entry; a holder that had\n    bumped cs_count made it return early, so the next iteration\n    re-decremented and burned the holder's reference.\n\n  - OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise\n    used _free_cpntf_state_locked() and could drop 2-\u003e1 without unlinking.\n\nAdd revoke_cpntf_state_locked(), which unhashes the entry from the IDR and\nsc_cp_list first (deferring the final free to any holder), and use it from\nall three revoke paths. The drain now walks with list_for_each_entry_safe()\nand revokes each entry unconditionally, so it terminates in one pass per\nentry regardless of cs_count. The unhash is gated on\n!list_empty(\u0026cps-\u003ecp_list); the idr_remove() gate matters because\nidr_alloc_cyclic() may have recycled the so_id by then. Keep\n_free_cpntf_state_locked() for the reference-holder put path only, where a\nconcurrent revoke may already have unlinked the entry (its list_del_init()\nthen a no-op).",
  "id": "CVE-2026-89663",
  "modified": "2026-09-15T03:30:51.246439461Z",
  "published": "2026-09-11T19:45:50.577Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/06a62f6dbc60791f4229c6950b1eec6b18df9af1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5f00e0ab4de45d4f9e4bd0883cf2517acf63fc0d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6b8149448cdcb476fba4559d1ecc247efee9971b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a1fca0f7bbb7b100a39c7ba8dd7922c87c4237a3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b56d2c5f01cddbeca7d11cce81d97db4ec9a464f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/caddbeffab1eaba1d2bcf5ceda35547863466705"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ff8a3cff02b92b2a82f1a9876038fcf953ae9c25"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89663.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89663"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nfsd: revoke copy-notify stateids before dropping their reference"
}