What is CVE-2026-89684?

CVE-2026-89684 is a High severity Linux kernel vulnerability with a CVSS score of 7.5 out of 10, affecting Linux kernel versions from 5.6 onward and patched in 5.10.270, 5.15.221, 6.1.188 and others. CVE-2026-89684 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-89684?

CVE-2026-89684 has a CVSS score of 7.5 out of 10, rated High severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-89684?

Yes, CVE-2026-89684 has been patched. Fixed versions include 5.10.270, 5.15.221, 6.1.188 and others. If you are running Linux kernel 5.6 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-89684 actively exploited?

CVE-2026-89684 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-89684

High

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL} from kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as cnr_stateid, so any NFSv4.2 client can drive it) reaches manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on the zeroed list_head, oopsing the server. Fold the cs_type assignment and the list_add() into the same critical section as idr_alloc_cyclic(), so a concurrent lookup either misses the entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after allocation and switch _free_cpntf_state_locked() to list_del_init() so a stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and skips the list_add, preserving NFS4_COPY_STID semantics.

Package Linux Kernel

Published 2026-09-11

Last modified 2026-09-14

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.5

out of 10

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 5.6 and later are affected. Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 and their respective stable series.

Affected from

≥ 5.6

Fixed in

✓ 5.10.270 5.10.x ✓ 5.15.221 5.15.x ✓ 6.1.188 6.1.x ✓ 6.6.157 6.6.x ✓ 6.12.109 6.12.x ✓ 6.18.50 6.18.x ✓ 7.2.4 7.2.x ✓ 7.3-rc1

References

8 total

Showing 5 of 8 references View all on NVD

Details

CVE ID CVE-2026-89684

Severity High

CVSS score 7.5 / 10

CVSS version 3.1

Published 2026-09-11

Modified 2026-09-14

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-89684?

CVE-2026-89684 is a High severity Linux kernel vulnerability with a CVSS score of 7.5 out of 10 . It affects Linux kernel versions from 5.6 onward and has been patched in 5.10.270, 5.15.221, 6.1.188 and others. CVE-2026-89684 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-89684?

CVE-2026-89684 has a CVSS score of 7.5 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-89684?

Yes. CVE-2026-89684 has been patched. Fixed versions include 5.10.270, 5.15.221, 6.1.188 and others. If you are running Linux kernel 5.6 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-89684 actively exploited?

No. CVE-2026-89684 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.