In the Linux kernel, the following vulnerability has been resolved:
nfsd: check client ownership when cancelling a copy-notify stateid
On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st->si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid.
Compare the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade python3-perfUpgrade kernelUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade perfUpgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.188-233.385Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-modules-extra-common | Oct 13, 2026 | Sep 11, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Sep 30, 2026 | Sep 11, 2026 |
| Redhat_linux | — | No solution exists | Sep 18, 2026 | Sep 11, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Sep 11, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub