Linux nfsd: use-after-free on an nfs4_client freed during NFSv4.0 revoked-state cleanup

Impact

nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, then calls nfsd4_drop_revoked_stid(), which dereferences s->sc_client->cl_lock. A stateid reference does not pin the client, so a teardown racing that dropped lock can free the client while it is still in use. The cleanup runs from the laundromat, so a periodic sweep can collide with force_expire_client() driven by a write to clients/<id>/ctl. For a fleet whose NFS server sits on a storage or head node, the realistic outcome is a kernel crash of that server - and an NFS server crash stalls every GPU node mounting it, not just one. The fix skips a client already expiring and otherwise pins it with cl_rpc_users.

Who can reach it

Local race on the NFS server host between the laundromat and an administrative client expiry (a write to /proc/fs/nfsd clients/<id>/ctl). No tenant or remote NFS client path is described.

What to do

Update the NFS server host to a stable kernel carrying the fix; four backport commits are linked on the record. nfsd lives in the kernel, so this is a reboot of the server node with client mounts stalled or failed over, not a daemon restart. Batch with the other nfsd lifetime fixes published the same day so one window covers all of them.

References

Related entries

• Linux nfsd: use-after-free when a client is torn down while an expired delegation is being revokedCVE-2026-89659 · Linux NFS server (nfsd, revoke_delegation / nfs4_laundromat client lifetime)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed while admin state revocation drops client_lockCVE-2026-89660 · Linux NFS server (nfsd, nfsd4_revoke_states / revoke_one_stid client lifetime)Unscored
• Linux nfsd: writing unlock_filesystem after server shutdown walks freed state tables (use-after-free)CVE-2026-89661 · Linux NFS server (nfsd, /proc/fs/nfsd/unlock_filesystem -> nfsd4_cancel_copy_by_sb)Unscored
• Linux nfsd: lock owner freed by the laundromat while client teardown walks it, causing a NULL dereferenceCVE-2026-89662 · Linux NFS server (nfsd, __destroy_client lock-owner teardown / remove_blocked_locks)Unscored
• Linux nfsd: copy-notify stateid freed while still discoverable, a use-after-free on all three revoke pathsCVE-2026-89663 · Linux NFS server (nfsd, copy-notify stateids in s2s_cp_stateids / _free_cpntf_state_locked)Unscored
• Linux nfsd: POSIX ACL refs leak on every malformed NFSv4 OPEN compoundCVE-2026-89664 · Linux kernel nfsd (NFSv4 OPEN compound POSIX ACL release)Unscored