Cloudanix VulnDB

CVE-2026-89703

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux file-sharing software could let attackers remotely take control of servers without any password.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in nfsd4_drop_revoked_stid when SC_STATUS_FREED is not set on admin-revoked delegations, allowing the freed delegation to be re-added to cl_revoked and later dereferenced during __destroy_client traversal.

Why it matters to the business

Remote attackers may crash NFS servers or achieve kernel code execution on Linux systems exposing NFSv4, resulting in service outages or full host compromise with high urgency given the critical severity and 43 days since publication.

How an attack unfolds

An attacker establishes an NFSv4 session, obtains a delegation, triggers admin revocation, issues FREE_STATEID without the status flag being set, then forces client destruction to traverse the corrupted cl_revoked list and trigger the use-after-free.

How to fix it

Apply the upstream kernel patch that sets SC_STATUS_FREED in the SC_STATUS_ADMIN_REVOKED path of nfsd4_drop_revoked_stid, matching the pattern already used in nfsd4_free_stateid; rebuild and deploy updated kernels to all NFS servers.

How to confirm the fix worked

Inspect nfsd source for the SC_STATUS_FREED assignment in nfsd4_drop_revoked_stid, run regression tests exercising delegation revocation and client teardown, and verify absence of use-after-free reports in kernel logs under load.

Typical attack path

  1. Establish NFSv4 connection to target server
  2. Acquire a delegation on a file
  3. Cause delegation to be admin-revoked
  4. Issue FREE_STATEID operation
  5. Trigger client cleanup path to dereference freed object

How to detect it

Search kernel logs and dmesg for oops/panic messages referencing nfsd, cl_revoked list traversal, or use-after-free during client destruction; correlate with NFSv4 FREE_STATEID and delegation revocation events.

What your security team should do

  • Prioritize kernel updates on all systems running nfsd within the next patch cycle
  • Temporarily restrict NFSv4 access to trusted clients if updates cannot be applied immediately
  • Enable kernel hardening features such as KASAN in test environments to catch similar issues

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before releasing cl_lock. revoke_delegation() uses this flag to detect whether FREE_STATEID has already processed the delegation -- without it, the freed delegation is added to cl_revoked via list_add(), producing a use-after-free when cl_revoked is later traversed in __destroy_client(). The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already sets SC_STATUS_FREED correctly. Apply the same pattern to the SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().

Affected packages

Ecosystem Package Introduced Fixed