CVE-2026-89703 - Vulnerability Details

- nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked
delegations but does not set SC_STATUS_FREED before releasing cl_lock.
revoke_delegation() uses this flag to detect whether FREE_STATEID has
already processed the delegation -- without it, the freed delegation is
added to cl_revoked via list_add(), producing a use-after-free when
cl_revoked is later traversed in __destroy_client().

The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already
sets SC_STATUS_FREED correctly. Apply the same pattern to the
SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

nfsd4_drop_revoked_stid processes FREE_STATEID for admin‑revoked delegations but fails to set the SC_STATUS_FREED flag before releasing cl_lock. Without this flag, the freed delegation is readded to the revoked list, causing a use‑after cleanup. The flaw can crash the kernel and deny service to NFS clients.

Affected Systems

All Linux kernel releases that have not incorporated commit 1e479576 are vulnerable. The affected products are all distributions that ship the legacy Linux kernel without the SC_STATUS_FREED fix under the vendor identifier Linux:Linux.

Risk and Exploitability

The CVSS score of 9.8 classifies this vulnerability as critical severity. The EPSS score of < 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is network‑based: an attacker would need an NFSv4 client capable of sending a FREE_STATEID request for an admin‑revoked delegation to the vulnerable NFS server. Because control is limited to a specific NFS protocol operation, remote code execution is not possible; the primary impact is a kernel crash leading to denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a`	affected	< d832a0587528853d45481d1faf75d4b5d062adaf
`8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a`	affected	< 1e4795766719ffd74b8cf0f2fde4a1350f8326bf
`8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a`	affected	< a6d89032e5c6620d5bb44582a72555ce07bf1c2e
`8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a`	affected	< 650d370cfbc66a96dd14d517bd704689b5bda4e5
`967faa26f313a62e7bebc55d5b8122eaee43b929`	affected	—
`6.11.6`	affected	< 6.12

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a,d832a0587528853d45481d1faf75d4b5d062adaf)`	affected	code_commit	—
`[8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a,1e4795766719ffd74b8cf0f2fde4a1350f8326bf)`	affected	code_commit	—
`[8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a,a6d89032e5c6620d5bb44582a72555ce07bf1c2e)`	affected	code_commit	—
`[8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a,650d370cfbc66a96dd14d517bd704689b5bda4e5)`	affected	code_commit	—
`967faa26f313a62e7bebc55d5b8122eaee43b929`	affected	code_commit	—
`[6.11.6,6.12)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.12`	affected	semver	—
`[0,6.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes commit 1e479576, which sets SC_STATUS_FREED before releasing cl_lock.
Reboot the system to load the updated kernel and ensure the NFS service runs with the patch applied.
If patching cannot be performed immediately, block or disable NFSv4 traffic, for example by blocking port 2049 in the firewall or disabling the nfsd service, to limit exposure until the kernel is updated.

Generated by OpenCVE AI on September 15, 2026 at 19:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00652.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf
https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5
https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e
https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf
https://nvd.nist.gov/vuln/detail/CVE-2026-89703
https://www.cve.org/CVERecord?id=CVE-2026-89703

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89703 https://www.cve.org/CVERecord?id=CVE-2026-89703
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sat, 12 Sep 2026 10:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before releasing cl_lock. revoke_delegation() uses this flag to detect whether FREE_STATEID has already processed the delegation -- without it, the freed delegation is added to cl_revoked via list_add(), producing a use-after-free when cl_revoked is later traversed in __destroy_client(). The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already sets SC_STATUS_FREED correctly. Apply the same pattern to the SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().
Title		nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5 https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:20.280Z

Updated: 2026-09-13T06:33:24.763Z

Reserved: 2026-09-11T19:38:34.750Z

Link: CVE-2026-89703

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:57.537

Modified: 2026-09-13T07:17:35.860

Link: CVE-2026-89703

Redhat

Severity : Important

Publid Date: 2026-09-11T19:46:20Z

Links: CVE-2026-89703 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T19:45:07Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object