Executive brief
The Linux kernel NFS server contains a race condition in copy state management that allows remote NFS clients to crash the server. An attacker can send concurrent OFFLOAD_CANCEL requests to trigger a kernel panic, causing denial of service on systems using NFS v4.2 copy operations.
Technical details
The vulnerability is a race condition in nfs4_alloc_init_cpntf_state() within the NFS server (NFSD) copy state initialization. The function published a new copy-notify state entry into the s2s_cp_stateids IDR and released a lock, creating a window where concurrent OFFLOAD_CANCEL requests could reach manage_cpntf_state() and call list_del() on an uninitialized (zeroed) list_head, causing a kernel oops. The fix moves cs_type assignment and list_add() operations inside the same critical section as idr_alloc_cyclic(), ensures the list_head is initialized with INIT_LIST_HEAD(), and switches to list_del_init() to make stale unlinks safe. The vulnerability requires network access and can be triggered by any NFS v4.2 client issuing OFFLOAD_CANCEL with a valid copy state ID.
Affected products
- Linux Linux kernel Multiple versions (see patch history)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched