CVE-2026-89703
Received Received - Intake

Use-After-Free in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before releasing cl_lock. revoke_delegation() uses this flag to detect whether FREE_STATEID has already processed the delegation -- without it, the freed delegation is added to cl_revoked via list_add(), producing a use-after-free when cl_revoked is later traversed in __destroy_client(). The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already sets SC_STATUS_FREED correctly. Apply the same pattern to the SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89703
EUVD
EUVD-2026-76615

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd). It occurs when handling FREE_STATEID for admin-revoked delegations. The function nfsd4_drop_revoked_stid() fails to set the SC_STATUS_FREED flag before releasing a lock, causing a delegation to be incorrectly added to cl_revoked. Later, when cl_revoked is processed, this leads to a use-after-free error.

Impact Analysis

If exploited, this could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. Systems running vulnerable NFS server configurations are at risk.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the use-after-free issue in NFS delegation handling. Monitor for unusual system behavior or crashes related to NFS operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89703. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart