CVE-2026-89659

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during delegation revoke

A delegation stateid holds only a bare pointer to its owning

nfs4_client and does not keep it alive. The client survives its

stateids only because __destroy_client() drains cl_delegations and

cl_revoked before free_client() runs.

nfs4_laundromat() breaks that invariant: it unhashes an

expired delegation from cl_delegations, drops deleg_lock, then

revoke_delegation() relinks it onto cl_revoked under cl_lock. In that

window the delegation is on neither list, so client_has_state() can

report no remaining state.

Every teardown path first requires cl_rpc_users to be zero, but

the laundromat holds no such reference. A client whose recalled

delegation has just timed out can therefore reach free_client()

while revoke_delegation() is still about to dereference cl_lock,

a use-after-free.

Pin the client with cl_rpc_users across the revoke so teardown blocks

unti

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References