SB20260912103 - Expired pointer dereference in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Expired pointer dereference (CVE-ID: CVE-2026-89676)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an expired pointer dereference in the nfsd asynchronous COPY stateid IDR handling when processing asynchronous NFS COPY requests. A remote attacker can submit an asynchronous COPY request to cause a denial of service.

Exploitation requires an IDR walker to dereference reused request memory whose contents resemble an expired NFS4_COPYNOTIFY_STID.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02
• https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a
• https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114