{"id":"CVE-2026-89658","revision":"e6a575f50fef4c80bf295993415a9e09","records":[{"revision":"e6a575f50fef4c80bf295993415a9e09","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89658","aliases":[],"title":"NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup\n\nnfs40_clean_admin_revoked() takes a stateid reference under\nclp->cl_lock, drops nn->client_lock, and calls\nnfsd4_drop_revoked_stid(), which dereferences the stateid's client\nthrough s->sc_client->cl_lock.  The stateid reference does not pin the\nclient, so a teardown racing the dropped lock can free the client\nwhile nfsd4_drop_revoked_stid() is still using it.\n\nThis cleanup runs from the laundromat, so a periodic sweep can race\nforce_expire_client() driven by a write to the clients/<id>/ctl file.\n\nSkip a client that is already expiring and otherwise pin it with\ncl_rpc_users under client_lock before dropping the lock, matching\nnfsd4_revoke_states().","state":0,"publishedAt":"2026-09-11T19:45:46.857+00:00","modifiedAt":"2026-10-19T08:50:29.852+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfsd/nfs4state.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d688d8585e6bea5e4e37f7497feea93b6b0a469c\",\n                            \"lessThan\": \"0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d688d8585e6bea5e4e37f7497feea93b6b0a469c\",\n                            \"lessThan\": \"b413ec5b23e3445dc9c4f273116078e2d4747626\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d688d8585e6bea5e4e37f7497feea93b6b0a469c\",\n                            \"lessThan\": \"81cf7f1413862f87b078920c838460a6a88aa030\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d688d8585e6bea5e4e37f7497feea93b6b0a469c\",\n                            \"lessThan\": \"7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfsd/nfs4state.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519","https://git.kernel.org/stable/c/b413ec5b23e3445dc9c4f273116078e2d4747626","https://git.kernel.org/stable/c/81cf7f1413862f87b078920c838460a6a88aa030","https://git.kernel.org/stable/c/7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89658","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89658","identifiers":["CVE-2026-89658"]},"retained":false,"historicalAffected":[]}],"coverage":[]}