CVE-2026-89703

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked
delegations but does not set SC_STATUS_FREED before releasing cl_lock.
revoke_delegation() uses this flag to detect whether FREE_STATEID has
already processed the delegation -- without it, the freed delegation is
added to cl_revoked via list_add(), producing a use-after-free when
cl_revoked is later traversed in __destroy_client().

The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already
sets SC_STATUS_FREED correctly. Apply the same pattern to the
SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().

Analysis

Technical impact

nfsd4_drop_revoked_stid processes FREE_STATEID for admin‑revoked delegations but fails to set the SC_STATUS_FREED flag before releasing cl_lock. Without this flag, the freed delegation is readded to the revoked list, causing a use‑after cleanup. The flaw can crash the kernel and deny service to NFS clients.

Affected Systems

All Linux kernel releases that have not incorporated commit 1e479576 are vulnerable. The affected products are all distributions that ship the legacy Linux kernel without the SC_STATUS_FREED fix under the vendor identifier Linux:Linux.

Risk and Exploitability

The CVSS score of 9.8 classifies this vulnerability as critical severity. The EPSS score of < 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is network‑based: an attacker would need an NFSv4 client capable of sending a FREE_STATEID request for an admin‑revoked delegation to the vulnerable NFS server. Because control is limited to a specific NFS protocol operation, remote code execution is not possible; the primary impact is a kernel crash leading to denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a`	affected	< d832a0587528853d45481d1faf75d4b5d062adaf
`8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a`	affected	< 1e4795766719ffd74b8cf0f2fde4a1350f8326bf
`8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a`	affected	< a6d89032e5c6620d5bb44582a72555ce07bf1c2e
`8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a`	affected	< 650d370cfbc66a96dd14d517bd704689b5bda4e5
`967faa26f313a62e7bebc55d5b8122eaee43b929`	affected	—
`6.11.6`	affected	< 6.12

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a,d832a0587528853d45481d1faf75d4b5d062adaf)`	affected	code_commit	—
`[8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a,1e4795766719ffd74b8cf0f2fde4a1350f8326bf)`	affected	code_commit	—
`[8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a,a6d89032e5c6620d5bb44582a72555ce07bf1c2e)`	affected	code_commit	—
`[8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a,650d370cfbc66a96dd14d517bd704689b5bda4e5)`	affected	code_commit	—
`967faa26f313a62e7bebc55d5b8122eaee43b929`	affected	code_commit	—
`[6.11.6,6.12)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.12`	affected	semver	—
`[0,6.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes commit 1e479576, which sets SC_STATUS_FREED before releasing cl_lock.
Reboot the system to load the updated kernel and ensure the NFS service runs with the patch applied.
If patching cannot be performed immediately, block or disable NFSv4 traffic, for example by blocking port 2049 in the firewall or disabling the nfsd service, to limit exposure until the kernel is updated.

Generated by OpenCVE AI on September 15, 2026 at 19:33 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.617% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf
https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5
https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e
https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf
https://nvd.nist.gov/vuln/detail/CVE-2026-89703
https://www.cve.org/CVERecord?id=CVE-2026-89703

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 4:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89703 https://www.cve.org/CVERecord?id=CVE-2026-89703
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 12, 2026 10:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before releasing cl_lock. revoke_delegation() uses this flag to detect whether FREE_STATEID has already processed the delegation -- without it, the freed delegation is added to cl_revoked via list_add(), producing a use-after-free when cl_revoked is later traversed in __destroy_client(). The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already sets SC_STATUS_FREED correctly. Apply the same pattern to the SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().
Title		nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5 https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf