CVE-2026-89658
Received Received - Intake

Use-After-Free in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4_drop_revoked_stid() is still using it. This cleanup runs from the laundromat, so a periodic sweep can race force_expire_client() driven by a write to the clients/<id>/ctl file. Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89658
EUVD
EUVD-2026-76570

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's NFS server implementation. It occurs during cleanup of revoked states in NFSv4.0. A race condition can happen where a client is freed while still being accessed by the cleanup process, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFSv4.0 implementation and involves a use-after-free condition during state cleanup. Detection requires checking kernel logs for NFS-related errors or crashes, particularly during client state revocation. Monitor for kernel oops messages or system hangs related to NFS operations.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior in systems running NFSv4.0 servers. Attackers might exploit it to trigger denial-of-service conditions or execute arbitrary code with kernel privileges.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If immediate patching is not possible, disable NFSv4.0 support by mounting NFS shares with the 'vers=3' option or restrict access to NFS services until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89658. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart