UBUNTU-CVE-2026-89688: Use After Free
In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop() the stateid is obtained from nfsd4lookupstateid(), which holds a reference on the nfs4stid (sccount) but takes no reference on the stateowner. openlockstateid() merely casts that stid and likewise takes no reference. When nfsd4cstateassignreplay() returns -EAGAIN (the replay owner is being torn down, RPUNHASHED) it has not taken a stateowner reference on that path. The error handling nevertheless called nfs4putstateowner(stp->ststateowner), dropping an socount reference the function never acquired -- risking a stateowner refcount underflow and use-after-free -- while leaking the sccount reference held on the stid. The leaked stid reference can also stall a concurrent nfsd4closeopenstateid() waiting for sccount to drop. Drop the reference actually held -- the stid -- before retrying. The stateowner stays alive through the reference held by the stid. This mirrors the open path in nfsd4processopen1(), where the put balances a reference that path explicitly holds on the stateowner.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In nfs4_preprocess_seqid_op() error handling for seqid_op replay retry when nfs4_cstate_assign_replay() returns -EAGAIN, drop the nfs4_stid (sc_count) reference before retrying instead of calling nfs4_put_stateowner(stp->st_stateowner).