CVE-2026-89660

Received Received - Intake

Use-After-Free in Linux Kernel NFSD

Publication date: 2026-09-11

Last updated on: 2026-09-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it. The client survives only because __destroy_client() drains its stateids before free_client() runs. nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(), which dereferences the client to revoke a stateid and read clp->cl_minorversion. A teardown racing the dropped lock can free the client first. Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and EXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero. force_expire_client() ignores it: once its wait for cl_rpc_users to reach zero has passed, a later pin goes unnoticed. Under client_lock, skip a client whose cl_time is already zero -- force_expire_client() clears it there before waiting -- otherwise pin cl_rpc_users before dropping the lock. The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-21

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89660

EUVD

EUVD-2026-76572

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows a client to use-after-free during admin state revocation. A stateid references an nfs4_client without pinning it, and a race condition during client teardown can free the client before stateids are properly revoked. Pinning cl_rpc_users under client_lock prevents this by blocking client teardown until revocation completes.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS daemon (NFSD) and involves a use-after-free issue during state revocation. Detection requires kernel-level inspection rather than network commands. Check kernel logs for NFS-related errors or crashes, particularly during client state revocation events. Monitor for kernel panics or oops messages related to nfsd or stateid handling.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. Attackers might trigger a use-after-free condition to execute arbitrary code or cause denial-of-service by crashing the system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel issue involving client state revocation and use-after-free conditions in the NFS daemon. Compliance impacts would depend on system-specific implementations and compensating controls rather than the vulnerability itself.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the use-after-free vulnerability in NFSD. Monitor for unusual client behavior or crashes during stateid revocation.

Hi! I’m here to help you understand CVE-2026-89660. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70