Linux nfsd: use-after-free when a client is torn down while an expired delegation is being revoked

Impact

A delegation stateid holds only a bare pointer to its nfs4_client; the client survives because __destroy_client() drains cl_delegations and cl_revoked first. nfs4_laundromat() breaks that invariant - it unhashes an expired delegation, drops deleg_lock, and revoke_delegation() relinks it onto cl_revoked, leaving a window where the delegation is on neither list and client_has_state() reports no remaining state. The laundromat holds no cl_rpc_users reference, so a client whose recalled delegation just timed out can reach free_client() while revoke_delegation() is about to touch cl_lock. On a storage or head node exporting NFS to the fleet, this is a kernel-level crash of the server, which stalls every GPU node mounting it. The fix pins the client across the revoke.

Who can reach it

Local to the NFS server host: a timing race between the laundromat's delegation-recall timeout and client teardown. No tenant-controlled path is described, though normal client churn plus a recalled delegation is enough to open the window.

What to do

Update the NFS server host to a stable kernel carrying the fix (three backport commits linked on the record). Because nfsd is in-kernel, remediation is a reboot of the server node - plan for mounts to stall or fail over during it - not a service restart. Batch with the other nfsd client-lifetime fixes from the same day.

References

Related entries

• Linux nfsd: use-after-free on an nfs4_client freed while admin state revocation drops client_lockCVE-2026-89660 · Linux NFS server (nfsd, nfsd4_revoke_states / revoke_one_stid client lifetime)Unscored
• Linux nfsd: writing unlock_filesystem after server shutdown walks freed state tables (use-after-free)CVE-2026-89661 · Linux NFS server (nfsd, /proc/fs/nfsd/unlock_filesystem -> nfsd4_cancel_copy_by_sb)Unscored
• Linux nfsd: lock owner freed by the laundromat while client teardown walks it, causing a NULL dereferenceCVE-2026-89662 · Linux NFS server (nfsd, __destroy_client lock-owner teardown / remove_blocked_locks)Unscored
• Linux nfsd: copy-notify stateid freed while still discoverable, a use-after-free on all three revoke pathsCVE-2026-89663 · Linux NFS server (nfsd, copy-notify stateids in s2s_cp_stateids / _free_cpntf_state_locked)Unscored
• Linux nfsd: POSIX ACL refs leak on every malformed NFSv4 OPEN compoundCVE-2026-89664 · Linux kernel nfsd (NFSv4 OPEN compound POSIX ACL release)Unscored
• Linux nfsd: unvalidated NFSv3 nseconds corrupts on-disk timestamps on ext4 and XFSCVE-2026-89666 · Linux kernel nfsd (NFSv3 SETATTR/CREATE timestamp validation)Unscored