CVE-2026-89676
A critical flaw in the Linux kernel’s NFS server could let an attacker corrupt memory during asynchronous copy operations. The bug involves a dangling pointer to a temporary buffer that can be exploited to crash the system or potentially run arbitrary code. The issue has been fixed in recent kernel updates.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel NFS server (nfsd) in all versions before the patch; typical users are system administrators running NFS services on Linux.
Real-world impact
An attacker could crash the NFS server or potentially execute arbitrary code, leading to denial of service or compromise of the affected system.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, and the fact that it can be exploited remotely without authentication or user interaction.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the fix for the nfsd stale s2s_cp_stateids IDR entry.
- 02Reboot the system to load the new kernel.
NVD description indicates the vulnerability has been resolved in the Linux kernel
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.