CVE-2026-89660

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during admin state revocation

A stateid holds only a bare pointer to its nfs4_client; a stateid

reference does not pin it. The client survives only because

__destroy_client() drains its stateids before free_client() runs.

nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(),

which dereferences the client to revoke a stateid and read

clp->cl_minorversion. A teardown racing the dropped lock can free

the client first.

Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and

EXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero.

force_expire_client() ignores it: once its wait for cl_rpc_users to

reach zero has passed, a later pin goes unnoticed.

Under client_lock, skip a client whose cl_time is already zero --

force_expire_client() clears it there before waiting -- otherwise pin

cl_rpc_users before dropping the lock. The walk then either

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References