CVE-2026-89658

NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

nfs40_clean_admin_revoked() takes a stateid reference under
clp->cl_lock, drops nn->client_lock, and calls
nfsd4_drop_revoked_stid(), which dereferences the stateid's client
through s->sc_client->cl_lock. The stateid reference does not pin the
client, so a teardown racing the dropped lock can free the client
while nfsd4_drop_revoked_stid() is still using it.

This cleanup runs from the laundromat, so a periodic sweep can race
force_expire_client() driven by a write to the clients/<id>/ctl file.

Skip a client that is already expiring and otherwise pin it with
cl_rpc_users under client_lock before dropping the lock, matching
nfsd4_revoke_states().

Analysis

Technical impact

The Linux kernel’s NFS daemon contains a race condition that can free a NFS client while it is still in use by a background cleanup routine, causing a use‑after‑free and possible kernel memory corruption. The flaw is a classic denial attacker could crash the kernel or corrupt memory to execute arbitrary code.

Affected Systems

All Linux distributions that ship the Linux kernel with an unpatched nfsd component are affected. The flaw resides in the NFSv4.0 server code; any kernel that includes the nfsd module without the commit that fixes the race condition is vulnerable. No specific kernel versions were listed, so any release prior to the fix should be considered at risk.

Risk and Exploitability

The CVSS vector scores a 9.8, placing it in the critical zone. The EPSS score is less than 1%, indicating that while exploitation is unlikely now, the high severity and lack of a publicly known exploit mean prompt action is warranted. The flaw can be triggered by writing to a client control file such as clients/<id>/ctl; based on the description it is inferred that this requires root or equivalent privileges, so the vulnerability is likely exploitable only by privileged users. The vulnerability does not appear in the CISA KEV list, but the critical score and kernel impact make remediation a priority.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d688d8585e6bea5e4e37f7497feea93b6b0a469c`	affected	< 0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519
`d688d8585e6bea5e4e37f7497feea93b6b0a469c`	affected	< b413ec5b23e3445dc9c4f273116078e2d4747626
`d688d8585e6bea5e4e37f7497feea93b6b0a469c`	affected	< 81cf7f1413862f87b078920c838460a6a88aa030
`d688d8585e6bea5e4e37f7497feea93b6b0a469c`	affected	< 7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[d688d8585e6bea5e4e37f7497feea93b6b0a469c,0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519)`	affected	code_commit	—
`[d688d8585e6bea5e4e37f7497feea93b6b0a469c,b413ec5b23e3445dc9c4f273116078e2d4747626)`	affected	code_commit	—
`[d688d8585e6bea5e4e37f7497feea93b6b0a469c,81cf7f1413862f87b078920c838460a6a88aa030)`	affected	code_commit	—
`[d688d8585e6bea5e4e37f7497feea93b6b0a469c,7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.9`	affected	semver	—
`[0,6.9)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*)`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that includes the commit fixing the nfsd race condition (0ae0d2b5c5a1b39c0b3c15d96b32a5b0c).
Remove write permission from the clients/<id>/ctl file so that only privileged administrators the client teardown race can be triggered.
If the NFS service is not required, disable or uninstall the nfsd daemon to eliminate the vulnerable code from the running kernel.

Generated by OpenCVE AI on September 15, 2026 at 20:46 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.617% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519
https://git.kernel.org/stable/c/7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55
https://git.kernel.org/stable/c/81cf7f1413862f87b078920c838460a6a88aa030
https://git.kernel.org/stable/c/b413ec5b23e3445dc9c4f273116078e2d4747626
https://nvd.nist.gov/vuln/detail/CVE-2026-89658
https://www.cve.org/CVERecord?id=CVE-2026-89658

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89658 https://www.cve.org/CVERecord?id=CVE-2026-89658
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4_drop_revoked_stid() is still using it. This cleanup runs from the laundromat, so a periodic sweep can race force_expire_client() driven by a write to the clients/<id>/ctl file. Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().
Title		NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519 https://git.kernel.org/stable/c/7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55 https://git.kernel.org/stable/c/81cf7f1413862f87b078920c838460a6a88aa030 https://git.kernel.org/stable/c/b413ec5b23e3445dc9c4f273116078e2d4747626