CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid
CVE-2026-89694 is a vulnerability in nfsd: check client ownership when cancelling a copy-notify stateid, rated Important by Microsoft, with a CVSS 3.1 base score of 7.1 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.22% probability of exploitation activity in the next 30 days, higher than 12% of all scored vulnerabilities. Microsoft released the fix on 12 September 2026 in the September 2026 Patch Tuesday. It affects 2 products in 1 product family (Open Source Software).
Key facts
- CVE ID
- CVE-2026-89694
- Severity
- High CVSS 7.1
- Microsoft severity
- Important
- Exploited in the wild
- No
- Publicly disclosed
- No
- EPSS
- 0.22% (percentile 12%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- September 2026 Patch Tuesday
- Product families
- Open Source Software
CVSS score and vector
Microsoft scores CVE-2026-89694 at 7.1 (temporal 7.1) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | None |
| Integrity impact | High |
| Availability impact | Low |
Affected products (2)
Open Source Software
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| azl3 kernel 6.6.152.1-1 on Azure Linux 3.0 | Release Notes | Security Update | 6.6.157.1-1 | |
| azl3 kernel 6.6.150.1-1 on Azure Linux 3.0 | Security update | Security Update |
NIST NVD data
- NVD status
- Received
- Published to NVD
- NVD last modified
References
- https://git.kernel.org/stable/c/6bba72b8ee68ad631b94bd439592cba46de54d7d
- https://git.kernel.org/stable/c/6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf
- https://git.kernel.org/stable/c/75268f6cfe26b09a7e4d3216367e87fe9e2a26aa
- https://git.kernel.org/stable/c/81b2cfe767943922eca906a2a5af23a0ce5d0f35
- https://git.kernel.org/stable/c/88daaed26e17e1c7e851859b5bbb4f0e1ab6d0e9
- https://git.kernel.org/stable/c/b1eca07303594ca27f5dc360a6946bd7e1f5b04c
- https://git.kernel.org/stable/c/b42dc26a14b4ad5d6daaada11ec4c70744141c25
- https://git.kernel.org/stable/c/d801906165cb5cc250d5cbe44935594e170be3e2
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | Information published. | |
| 3.0 | Information published. | |
| 4.0 | Information published. | |
| 5.0 | Information published. |