CVE-2026-89660

Received Received - Intake

Use-After-Free in Linux Kernel NFSD

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it. The client survives only because __destroy_client() drains its stateids before free_client() runs. nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(), which dereferences the client to revoke a stateid and read clp->cl_minorversion. A teardown racing the dropped lock can free the client first. Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and EXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero. force_expire_client() ignores it: once its wait for cl_rpc_users to reach zero has passed, a later pin goes unnoticed. Under client_lock, skip a client whose cl_time is already zero -- force_expire_client() clears it there before waiting -- otherwise pin cl_rpc_users before dropping the lock. The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89660

EUVD

EUVD-2026-76572

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows a client to use-after-free during admin state revocation. A stateid references an nfs4_client without pinning it, and a race condition during client teardown can free the client before stateids are properly revoked. Pinning cl_rpc_users under client_lock prevents this by blocking client teardown until revocation completes.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. Attackers might trigger a use-after-free condition to execute arbitrary code or cause denial-of-service by crashing the system.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the use-after-free vulnerability in NFSD. Monitor for unusual client behavior or crashes during stateid revocation.

Hi! I’m here to help you understand CVE-2026-89660. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70