CVE-2026-89688

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In nfs4_preprocess_seqid_op() the stateid is obtained from

nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid

(sc_count) but takes no reference on the stateowner. openlockstateid()

merely casts that stid and likewise takes no reference.

When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is

being torn down, RP_UNHASHED) it has not taken a stateowner reference on

that path. The error handling nevertheless called

nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference

the function never acquired -- risking a stateowner refcount underflow and

use-after-free -- while leaking the sc_count reference held on the stid.

The leaked stid reference can also stall a concurrent

nfsd4_close_open_stateid() waiting for sc_count to drop.

Drop the reference actually held -- the stid -- before retrying. The

stateowner sta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References