Executive brief
The Linux kernel's NFSD (Network File System Daemon) component that handles NFSv4.0 protocol contains a use-after-free vulnerability in its revoked-state cleanup routine. An attacker or race condition could cause the kernel to access freed memory while processing administrative state revocations, leading to system crashes or potential code execution. This affects systems exporting NFS shares, particularly when administrators revoke client state via the debugfs interface.
Technical details
The vulnerability is a use-after-free in the nfs40_clean_admin_revoked() function in fs/nfsd/nfs4state.c. The function takes a reference to an NFS state identifier (stateid) under a client lock, drops the lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's associated client structure. The stateid reference does not pin the client itself in memory, allowing a concurrent force_expire_client() call (triggered by writes to the clients/<id>/ctl debugfs file) to free the client while nfsd4_drop_revoked_stid() is still dereferencing it. The fix pins the client using cl_rpc_users reference counting while holding the lock, preventing premature deallocation. Attack vector is local (requires debugfs access or kernel scheduler timing), no authentication required for the race condition.
Affected products
- Linux Linux kernel Affected kernels prior to fix commit 7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55
Timeline
- 2026-09-11: disclosed: CVE-2026-89658 published
- 2026-07-09: patched: Upstream fix committed by Chuck Lever
- 2026-09-07: patched: Stable tree backport integrated