CVE-2026-89662

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent lock owner use-after-free during client teardown

__destroy_client() releases a client's open owners, but a lock owner

whose only reference is a blocked lock (nbl) stays on

cl_ownerstr_hashtbl. client_has_state() does not count a bare owner,

so DESTROY_CLIENTID can reach __destroy_client() with such owners

present.

__destroy_client() then walks the table, calling remove_blocked_locks()

on each owner without a reference. Freeing a blocked lock drops the

owner reference held via flc_owner. The per-net laundromat reaps

blocked locks from nn->blocked_locks_lru independently of client state.

The two paths share blocked_locks_lock only for the list splice, not

the owner's lifetime. The laundromat therefore frees the owner as

__destroy_client() dereferences it, a NULL dereference in

remove_blocked_locks().

nfsd4_release_lockowner() holds a reference across the same call;

__destroy_client() does not. Hold

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References