CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
nfs40cleanadminrevoked() takes a stateid reference under clp->cllock, drops nn->clientlock, and calls nfsd4droprevokedstid(), which dereferences the stateid's client through s->scclient->cllock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4droprevokedstid() is still using it.
This cleanup runs from the laundromat, so a periodic sweep can race forceexpireclient() driven by a write to the clients/<id>/ctl file.
Skip a client that is already expiring and otherwise pin it with clrpcusers under clientlock before dropping the lock, matching nfsd4revokestates().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required for this race to occur?
The affected path is NFSv4.0 revoked-state cleanup. The laundromat's periodic cleanup must race with force_expire_client(), which is triggered by writing to the clients/<id>/ctl file.
Who can trigger the competing client-expiration operation?
The description identifies a write to the clients/<id>/ctl file as the trigger for force_expire_client(). It does not specify which users or processes have permission to perform that write.
What can be done if the fix cannot be applied immediately?
Avoid creating the identified race between periodic laundromat cleanup and forced client expiration through clients/<id>/ctl. The provided data does not describe a complete mitigation or configuration change.