Linux nfsd: use-after-free on an nfs4_client freed while admin state revocation drops client_lock

Impact

nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(), which dereferences the client to revoke a stateid and read clp->cl_minorversion, while a stateid reference does not pin the client. A teardown racing the dropped lock frees the client first. Pinning cl_rpc_users blocks DESTROY_CLIENTID and EXCHANGE_ID teardown, but force_expire_client() ignores a pin taken after its own wait has passed, so the fix also skips any client whose cl_time is already zero. For an operator, the exposure is a kernel crash of the NFS server that the fleet mounts - one node's fault, every mounting GPU node's stall. The fix makes the walk either observe the expiry and skip, or pin in time for the expiry wait to cover the revoke.

Who can reach it

Local to the NFS server host: an administrative state revocation racing client expiry (including force_expire_client() via the nfsd control files). No remote or tenant path is described in the record.

What to do

Update the NFS server host to a stable kernel carrying the fix; three backport commits are linked on the record. nfsd is in-kernel, so the action is a reboot of the server node with mounts stalled or failed over - not a daemon restart. Batch with the other nfsd client-lifetime fixes published the same day.

References

Related entries

• Linux nfsd: writing unlock_filesystem after server shutdown walks freed state tables (use-after-free)CVE-2026-89661 · Linux NFS server (nfsd, /proc/fs/nfsd/unlock_filesystem -> nfsd4_cancel_copy_by_sb)Unscored
• Linux nfsd: lock owner freed by the laundromat while client teardown walks it, causing a NULL dereferenceCVE-2026-89662 · Linux NFS server (nfsd, __destroy_client lock-owner teardown / remove_blocked_locks)Unscored
• Linux nfsd: copy-notify stateid freed while still discoverable, a use-after-free on all three revoke pathsCVE-2026-89663 · Linux NFS server (nfsd, copy-notify stateids in s2s_cp_stateids / _free_cpntf_state_locked)Unscored
• Linux nfsd: POSIX ACL refs leak on every malformed NFSv4 OPEN compoundCVE-2026-89664 · Linux kernel nfsd (NFSv4 OPEN compound POSIX ACL release)Unscored
• Linux nfsd: unvalidated NFSv3 nseconds corrupts on-disk timestamps on ext4 and XFSCVE-2026-89666 · Linux kernel nfsd (NFSv3 SETATTR/CREATE timestamp validation)Unscored
• Linux nfsd: copy-notify stateid published before initialisation, freeable by a racing OFFLOAD_CANCELCVE-2026-89669 · Linux kernel nfsd (NFSv4.2 COPY_NOTIFY stateid)Unscored