In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dup_copy_fields() copies only the value into async_copy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cs_type from it and, if the bytes look like an expired NFS4_COPYNOTIFY_STID, follows into refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has the same exposure via idr_find().
Duplicate the fields first, then register the stateid on the stable async_copy. result->cb_stateid is unchanged.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool6.12Upgrade python3-perf6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-toolsUpgrade kernel6.12-debuginfoUpgrade kernel6.12-tools-develUpgrade perf6.12-debuginfoUpgrade kernel-livepatch-6.12.111-136.204Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-headersUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade perf6.12Upgrade kernel6.12-develUpgrade kernel6.12-modules-extraUpgrade bpftool6.12-debuginfoUpgrade kernel6.12 | Oct 13, 2026 | Sep 11, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Sep 30, 2026 | Sep 11, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Sep 22, 2026 | Sep 11, 2026 |
| Rocky_linux | — | Upgrade kernel-debug-debuginfoUpgrade kernel-debug-develUpgrade kernel-rt-coreUpgrade python3-perf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-toolsUpgrade kernel-coreUpgrade kernel-debug-modules-coreUpgrade rtlaUpgrade kernel-debug-modulesUpgrade kernel-modulesUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debugUpgrade kernel-modules-extra-matchedUpgrade kernel-debuginfoUpgrade kernel-debugUpgrade perfUpgrade kernelUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debuginfoUpgrade kernel-devel-matchedUpgrade rvUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libs-develUpgrade kernel-uki-virt-addonsUpgrade kernel-rtUpgrade kernel-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade libperfUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade perf-debuginfoUpgrade kernel-rt-modules-core | Oct 15, 2026 | Oct 9, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 30, 2026 | Sep 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub