Cloudanix VulnDB

CVE-2026-89660

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel code that handles network file shares can let remote attackers crash servers or potentially take them over.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Remote Code Execution
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in NFSD where nfs4_client pointer held by stateid is dereferenced after client teardown frees the object, due to dropped client_lock during revoke_one_stid and insufficient cl_rpc_users pinning against force_expire_client races.

Why it matters to the business

Remote attackers can trigger kernel crashes or memory corruption on NFS servers, causing denial of service or potential code execution that disrupts file-sharing services and requires emergency reboots or restores.

How an attack unfolds

Attacker issues NFSv4 operations that allocate stateids, then races DESTROY_CLIENTID/EXCHANGE_ID teardown against nfsd4_revoke_states by dropping client_lock, allowing a freed client to be dereferenced for cl_minorversion reads and state revocation.

How to fix it

Apply the upstream kernel commit that pins cl_rpc_users under client_lock before dropping it and skips clients with cl_time already zero; rebuild and deploy the patched kernel across all NFS servers.

How to confirm the fix worked

Confirm the fix is present by inspecting nfsd4_revoke_states and force_expire_client for the added client_lock-protected cl_rpc_users pin and cl_time zero check; test by exercising concurrent revoke and client expiry paths under load.

Typical attack path

  1. Establish NFSv4 client connection and acquire stateids
  2. Trigger concurrent client destruction path while revocation walk holds no lock
  3. Dereference stale client pointer to read cl_minorversion or perform revoke
  4. Exploit resulting use-after-free for memory corruption or crash

How to detect it

Monitor kernel logs for nfsd oops/panics referencing client_lock, revoke_one_stid, or cl_minorversion; correlate with unusual spikes in NFSv4 DESTROY_CLIENTID or state revocation events.

What your security team should do

  • Prioritize kernel updates on all exposed NFS servers within 30 days
  • Temporarily restrict NFSv4 access to trusted networks if patching is delayed
  • Enable kernel hardening features such as KASAN and lockdep for early detection of similar races

The record

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it. The client survives only because __destroy_client() drains its stateids before free_client() runs. nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(), which dereferences the client to revoke a stateid and read clp->cl_minorversion. A teardown racing the dropped lock can free the client first. Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and EXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero. force_expire_client() ignores it: once its wait for cl_rpc_users to reach zero has passed, a later pin goes unnoticed. Under client_lock, skip a client whose cl_time is already zero -- force_expire_client() clears it there before waiting -- otherwise pin cl_rpc_users before dropping the lock. The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.

Affected packages

Ecosystem Package Introduced Fixed