Go to homepageCyberStrike

Menu

Star on GitHub · 3.5k
Sign inDownload

CVE-2026-89703

9.8 · CRITICAL

In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-r…

Published Sep 11, 2026EPSS 0.62%

Overview

CVE-2026-89703 is a critical-severity vulnerability. It was published on September 11, 2026 and has a CVSS 3.1 base score of 9.8 (CRITICAL).

This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked

delegations but does not set SC_STATUS_FREED before releasing cl_lock.

revoke_delegation() uses this flag to detect whether FREE_STATEID has

already processed the delegation -- without it, the freed delegation is

added to cl_revoked via list_add(), producing a use-after-free when

cl_revoked is later traversed in __destroy_client().

The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already

sets SC_STATUS_FREED correctly. Apply the same pattern to the

SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bfRefgit.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5Refgit.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2eRefgit.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf

How CyberStrike helps

Frequently asked questions

What is CVE-2026-89703?

CVE-2026-89703 is a critical-severity vulnerability. It was published on September 11, 2026 and has a CVSS 3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-89703?

This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2026-89703?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-89703?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-89703 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related CRITICAL CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
CyberStrike v2 is here — more intelligence, greater reach