Critical Vulnerability: CVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix UAF in async copy cancel and shutdown

An async copy could be freed or used after free while a teardown caller

(OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the

copy kthread:

- find_async_copy() bumped copy->refcount but left the copy on

clp->async_copies, so the reaper's cleanup_async_copy() could run

release_copy_files() concurrently with a cancel/shutdown caller. Both

put and NULL nf_src/nf_dst without a common lock, double-putting the

nfsd_file and freeing it early.

- nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses

of the copy (nfsd_update_cmtime_attr() on copy->nf_dst,

nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit

as "kthread done, skip kthread_stop()", so a teardown caller ran

release_copy_files() -- which puts and NULLs nf_dst -- while the

kthread still dereferenced it (NULL/UAF).

- copy->co

CVE-2026-89675 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.8/10

EPSS (Exploit Prediction): 0.2% probability of exploitation in the next 30 days.

Use Vulnios to continuously monitor your exposure to CVE-2026-89675 and similar vulnerabilities.

Vulnios scans for this vulnerability using Trivy and Grype for SBOM-based CVE matching and Vulnios CVE feed continuous monitoring against your asset inventory. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.