CVE-2026-89659
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's file-sharing server could let remote attackers crash the system or run their own code.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in the Linux kernel NFSD delegation revocation path where a nfs4_client pointer is dereferenced after the structure has been freed because the laundromat drops locks and allows teardown while a delegation is temporarily unhashed.
Why it matters to the business
Remote attackers can crash or potentially execute arbitrary code on NFS servers, causing denial of service for file-sharing workloads and possible full system compromise with high urgency for any exposed Linux NFS deployments.
How an attack unfolds
An attacker with network access to an NFS server triggers delegation recall and timeout; the laundromat unhashes the delegation and drops locks, allowing a concurrent client teardown path to free the client while revoke_delegation still holds a reference, resulting in use-after-free.
How to fix it
Upgrade the Linux kernel to a version containing the fix that pins the client with cl_rpc_users across revoke_delegation and reaps the delegation safely from cl_revoked; rebuild and reboot affected systems.
How to confirm the fix worked
Confirm the running kernel contains the commit that adds cl_rpc_users pinning around revoke_delegation; verify client_has_state and laundromat paths no longer allow unhashed delegations during teardown.
Typical attack path
- Establish NFSv4 connection and acquire a delegation
- Force or wait for delegation recall timeout
- Trigger concurrent client state teardown via repeated requests or disconnects
- Race the laundromat revoke path against free_client
- Dereference freed client structure to achieve use-after-free
How to detect it
Search kernel logs for nfsd oops, use-after-free warnings, or crashes mentioning nfs4_client, delegations, or laundromat; inspect audit logs for unusual NFSv4 delegation recall patterns coinciding with client disconnects.
What your security team should do
- Prioritize kernel updates on all internet-facing or internal NFS servers within the next patching cycle
- Restrict NFSv4 access to trusted networks until patches are applied
- Monitor for kernel oops or crashes related to nfsd and delegation state
- Test patched kernels in a staging environment before broad deployment
The record
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive. The client survives its stateids only because __destroy_client() drains cl_delegations and cl_revoked before free_client() runs. nfs4_laundromat() breaks that invariant: it unhashes an expired delegation from cl_delegations, drops deleg_lock, then revoke_delegation() relinks it onto cl_revoked under cl_lock. In that window the delegation is on neither list, so client_has_state() can report no remaining state. Every teardown path first requires cl_rpc_users to be zero, but the laundromat holds no such reference. A client whose recalled delegation has just timed out can therefore reach free_client() while revoke_delegation() is still about to dereference cl_lock, a use-after-free. Pin the client with cl_rpc_users across the revoke so teardown blocks until it completes, then reap the delegation from cl_revoked. A client already expiring reaps its own, so skip it and leave the delegation on del_recall_lru.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|