CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent lock owner use-after-free during client teardown
destroyclient() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on clownerstrhashtbl. clienthasstate() does not count a bare owner, so DESTROYCLIENTID can reach destroyclient() with such owners present.
destroyclient() then walks the table, calling removeblockedlocks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flcowner. The per-net laundromat reaps blocked locks from nn->blockedlockslru independently of client state. The two paths share blockedlockslock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as destroyclient() dereferences it, a NULL dereference in removeblockedlocks().
nfsd4releaselockowner() holds a reference across the same call; destroyclient() does not. Hold cllock across the walk, taking a reference and unhashing each owner, then drop it before removeblockedlocks() and nfs4putstateowner(), which take blockedlockslock and cllock.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems running NFSD are exposed when NFS client teardown occurs while a lock owner remains referenced only by a blocked lock. The race involves the NFSD per-network laundromat reaping blocked locks concurrently with client destruction.
What conditions are required to trigger the failure?
A client must have a lock owner whose only remaining reference is a blocked lock, allowing DESTROY_CLIENTID to enter client teardown while that owner remains in the client owner hash table. Concurrent cleanup of the blocked lock can then free the owner while client teardown passes it to remove_blocked_locks(), resulting in a NULL dereference.