UBUNTU-CVE-2026-89661: Use After Free

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb() before nfsdmutex is held and before the handler confirms that nn->nfsdserv is set. Once nfsd has shut down, nfs4statedestroynet() has freed nn->confidhashtbl but left the pointer intact, so the cancel helper iterates freed slab memory as an array of struct listhead and then dereferences a bogus nfs4client when it takes clp->asynclock. A local administrator holding CAPSYSADMIN can reach this use-after-free by stopping the server and then writing to unlockfilesystem; KASAN reports a slab-use-after-free read in nfsd4cancelcopybysb(). nfsd4revokestates() walks the same state tables and for that reason already runs only under nfsdmutex with nn->nfsdserv confirmed present. Move the async COPY cancel into that protected section so every NFSv4 state-table walker on this path observes a running server. Async copies exist only while the server runs, so gating the cancel on nn->nfsdserv loses nothing.