CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
In the Linux kernel, the following vulnerability has been resolved:
nfsd: set SCSTATUSFREED in nfsd4droprevokedstid for delegations
nfsd4droprevokedstid() handles FREESTATEID for admin-revoked delegations but does not set SCSTATUSFREED before releasing cllock. revokedelegation() uses this flag to detect whether FREESTATEID has already processed the delegation -- without it, the freed delegation is added to clrevoked via listadd(), producing a use-after-free when clrevoked is later traversed in destroyclient().
The SCSTATUSREVOKED path in nfsd4freestateid() (line 7983) already sets SCSTATUSFREED correctly. Apply the same pattern to the SCSTATUSADMINREVOKED path in nfsd4droprevokedstid().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel nfsd4 code so that nfsd4_drop_revoked_stid() sets SC_STATUS_FREED when handling FREE_STATEID for admin-revoked delegations (as required so revoke_delegation() detects the FREE_STATEID and avoids the use-after-free during later traversal of cl_revoked in __destroy_client()).
Linux kernel (NFS nfsd4) SC_STATUS_FREED flag handling in nfsd4_drop_revoked_stid() = Set SC_STATUS_FREED for delegations on FREE_STATEID and ensure revoke_delegation() can detect FREE_STATEID via this flag
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
The issue requires an admin-revoked NFS delegation followed by FREE_STATEID processing for that delegation. The missing freed-status flag can then allow revoke_delegation() to add an already freed delegation to cl_revoked.
When does the invalid object get used?
The dangling delegation can be traversed later by __destroy_client() through the cl_revoked list. This creates the use-after-free condition.
What is the relevant mitigation if the fix cannot be applied immediately?
The provided data identifies the problematic sequence as handling FREE_STATEID for admin-revoked delegations. No supported configuration workaround or operational mitigation is specified.