UBUNTU-CVE-2026-89660: Use After Free

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient() drains its stateids before freeclient() runs. nfsd4revokestates() drops nn->clientlock across revokeonestid(), which dereferences the client to revoke a stateid and read clp->clminorversion. A teardown racing the dropped lock can free the client first. Pinning clrpcusers under clientlock blocks the DESTROYCLIENTID and EXCHANGEID teardown, which refuses while clrpcusers is non-zero. forceexpireclient() ignores it: once its wait for clrpcusers to reach zero has passed, a later pin goes unnoticed. Under clientlock, skip a client whose cltime is already zero -- forceexpireclient() clears it there before waiting -- otherwise pin clrpcusers before dropping the lock. The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.