CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during admin state revocation
A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient() drains its stateids before freeclient() runs.
nfsd4revokestates() drops nn->clientlock across revokeonestid(), which dereferences the client to revoke a stateid and read clp->clminorversion. A teardown racing the dropped lock can free the client first.
Pinning clrpcusers under clientlock blocks the DESTROYCLIENTID and EXCHANGEID teardown, which refuses while clrpcusers is non-zero. forceexpireclient() ignores it: once its wait for clrpcusers to reach zero has passed, a later pin goes unnoticed.
Under clientlock, skip a client whose cltime is already zero -- forceexpireclient() clears it there before waiting -- otherwise pin clrpcusers before dropping the lock. The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the use-after-free to occur?
The race requires administrative state revocation to process a stateid while nfsd4_revoke_states() has dropped nn->client_lock, and concurrent client teardown to free the associated nfs4_client. The vulnerable revoke path dereferences that client after the lock is dropped.
Which client teardown paths are relevant to this race?
DESTROY_CLIENTID and EXCHANGE_ID teardown are blocked when cl_rpc_users is non-zero. Forced expiration needs separate handling because force_expire_client() can begin waiting after cl_time is cleared, allowing a later pin to otherwise go unnoticed.
How can I verify that the fix is present in the source?
The corrected revoke walk checks under client_lock whether cl_time is already zero and skips that client. For clients not already expiring, it increments cl_rpc_users before dropping the lock so teardown waits cover the state revocation.