Cloudanix VulnDB

CVE-2026-89658

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in the Linux kernel's file-sharing service could let a remote attacker crash the server or take control of it without needing any login credentials.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in nfs40_clean_admin_revoked() where a stateid reference is taken under clp->cl_lock, the nn->client_lock is dropped, and nfsd4_drop_revoked_stid() then dereferences s->sc_client->cl_lock after the client may have been freed by a concurrent force_expire_client() from the laundromat or clients/<id>/ctl write.

Why it matters to the business

NFSv4 servers can experience remote-triggered kernel crashes or arbitrary code execution, resulting in denial of service, data corruption, or full host compromise with no authentication required.

How an attack unfolds

An attacker with network access to an NFSv4.0 server triggers repeated state revocation and client expiration operations; the periodic laundromat thread races with force_expire_client(), allowing the client object to be freed while nfsd4_drop_revoked_stid() still holds a dangling reference and attempts to acquire cl_lock.

How to fix it

Apply the upstream fix that skips expiring clients and pins the client with cl_rpc_users under client_lock before dropping nn->client_lock; rebuild and deploy the patched kernel across all affected NFS servers.

How to confirm the fix worked

Confirm the kernel source contains the cl_rpc_users pinning logic in nfs40_clean_admin_revoked(); run targeted NFSv4 revocation stress tests that previously triggered the race; monitor for absence of use-after-free crashes in dmesg during concurrent client expiration and laundromat activity.

Typical attack path

  1. Establish NFSv4.0 mount and obtain stateids
  2. Trigger administrative client revocation via clients/<id>/ctl or equivalent
  3. Force concurrent laundromat sweep of revoked stateids
  4. Race client teardown to free the client while nfsd4_drop_revoked_stid() dereferences it

How to detect it

Search kernel logs and dmesg for NFS laundromat or revoked-stateid related crashes, oops messages referencing cl_lock or sc_client after client expiration events; correlate with writes to clients/*/ctl and periodic nfsd4 state cleanup timestamps.

What your security team should do

  • Prioritize kernel updates on all internet-facing and internal NFSv4 servers within the next maintenance window
  • Disable NFSv4.0 if NFSv4.1+ is viable for the environment
  • Enable kernel hardening features such as KASAN and lockdep in test environments to surface similar races
  • Add monitoring for unexpected NFS server restarts correlated with client control file writes

The record

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4_drop_revoked_stid() is still using it. This cleanup runs from the laundromat, so a periodic sweep can race force_expire_client() driven by a write to the clients/<id>/ctl file. Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().

Affected packages

Ecosystem Package Introduced Fixed