CVE-2026-89688

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In nfs4_preprocess_seqid_op() the stateid is obtained from
nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid
(sc_count) but takes no reference on the stateowner. openlockstateid()
merely casts that stid and likewise takes no reference.

When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is
being torn down, RP_UNHASHED) it has not taken a stateowner reference on
that path. The error handling nevertheless called
nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference
the function never acquired -- risking a stateowner refcount underflow and
use-after-free -- while leaking the sc_count reference held on the stid.
The leaked stid reference can also stall a concurrent
nfsd4_close_open_stateid() waiting for sc_count to drop.

Drop the reference actually held -- the stid -- before retrying. The
stateowner stays alive through the reference held by the stid. This mirrors
the open path in nfsd4_process_open1(), where the put balances a reference
that path explicitly holds on the stateowner.

Analysis

Technical impact

In the Linux kernel NFS daemon, replay of a seqid operation can drop a reference to a state owner that was never taken, causing a reference count underflow on the stateowner and leaving a leaked state ID reference that can stall concurrent close operations. This flaw is an instance of improper resource management (CWE-825) that can lead to a use‑after‑free scenario within the kernel, potentially corrupting memory or crashing the system.

Affected Systems

The vulnerability resides in the NFSv4 implementation of the Linux kernel and affects all Linux distributions that ship the standard kernel, regardless of vendor. No specific kernel versions are listed in the data, indicating that the issue may exist in multiple recent releases until patched via an update.

Risk and Exploitability

The CVSS score of 9.8 denotes critical severity. The EPSS rank of <1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The issue can be triggered by a replayed seqid operation that causes an EAGAIN path dropping an unacquired stateowner reference, leading to a kernel reference count underflow and use‑after‑free, potentially crashing the system. Based on the description, it is inferred that an attacker would need the ability to send or influence NFSv4 requests to a vulnerable server, making the attack vector likely remote NFS traffic. Given the low EPSS and lack of public exploitation, the risk is critical but currently low likelihood.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`eec7620800081e27dbf8019ac2e66259f0d5bf6f`	affected	< 69ed78b6b947c9257213164678b4edf17533093b
`eec7620800081e27dbf8019ac2e66259f0d5bf6f`	affected	< 00843074d9b84824552c9679d423d29500ca5de0
`eec7620800081e27dbf8019ac2e66259f0d5bf6f`	affected	< f7cb90ddc021747fc9abfd4cf5252d425fd34eec
`eec7620800081e27dbf8019ac2e66259f0d5bf6f`	affected	< 5e4627d3513e60accfce9d5f4c7fa95251ef93d6

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[eec7620800081e27dbf8019ac2e66259f0d5bf6f,69ed78b6b947c9257213164678b4edf17533093b)`	affected	code_commit	—
`[eec7620800081e27dbf8019ac2e66259f0d5bf6f,00843074d9b84824552c9679d423d29500ca5de0)`	affected	code_commit	—
`[eec7620800081e27dbf8019ac2e66259f0d5bf6f,f7cb90ddc021747fc9abfd4cf5252d425fd34eec)`	affected	code_commit	—
`[eec7620800081e27dbf8019ac2e66259f0d5bf6f,5e4627d3513e60accfce9d5f4c7fa95251ef93d6)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.10`	affected	generic	—
`[0,6.10)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that contains the CVE‑2026‑89688 fix, which corrects the CWE‑825 reference counting bug in NFSd.
If an upgrade cannot be performed immediately, disable NFSv4 on the server or restrict NFSv4 traffic to trusted hosts using firewall or kernel configuration to reduce exposure to the reference count underflow.
After applying the patch, monitor system logs and kernel crash reports for any NFS‑related crashes or anomalous memory usage to confirm that the reference counting issue has been resolved.

Generated by OpenCVE AI on September 15, 2026 at 20:40 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.736% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00843074d9b84824552c9679d423d29500ca5de0
https://git.kernel.org/stable/c/5e4627d3513e60accfce9d5f4c7fa95251ef93d6
https://git.kernel.org/stable/c/69ed78b6b947c9257213164678b4edf17533093b
https://git.kernel.org/stable/c/f7cb90ddc021747fc9abfd4cf5252d425fd34eec
https://nvd.nist.gov/vuln/detail/CVE-2026-89688
https://www.cve.org/CVERecord?id=CVE-2026-89688

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89688 https://www.cve.org/CVERecord?id=CVE-2026-89688
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry In nfs4_preprocess_seqid_op() the stateid is obtained from nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid (sc_count) but takes no reference on the stateowner. openlockstateid() merely casts that stid and likewise takes no reference. When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is being torn down, RP_UNHASHED) it has not taken a stateowner reference on that path. The error handling nevertheless called nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference the function never acquired -- risking a stateowner refcount underflow and use-after-free -- while leaking the sc_count reference held on the stid. The leaked stid reference can also stall a concurrent nfsd4_close_open_stateid() waiting for sc_count to drop. Drop the reference actually held -- the stid -- before retrying. The stateowner stays alive through the reference held by the stid. This mirrors the open path in nfsd4_process_open1(), where the put balances a reference that path explicitly holds on the stateowner.
Title		nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/00843074d9b84824552c9679d423d29500ca5de0 https://git.kernel.org/stable/c/5e4627d3513e60accfce9d5f4c7fa95251ef93d6 https://git.kernel.org/stable/c/69ed78b6b947c9257213164678b4edf17533093b https://git.kernel.org/stable/c/f7cb90ddc021747fc9abfd4cf5252d425fd34eec