Linux nfsd: lock owner freed by the laundromat while client teardown walks it, causing a NULL dereference

Impact

__destroy_client() releases open owners, but a lock owner whose only reference is a blocked lock stays on cl_ownerstr_hashtbl, and client_has_state() does not count a bare owner - so DESTROY_CLIENTID can reach __destroy_client() with such owners present. It then calls remove_blocked_locks() on each owner without holding a reference, while the per-net laundromat reaps blocked locks from nn->blocked_locks_lru independently; the two paths share blocked_locks_lock only for the list splice, not the owner's lifetime. The laundromat frees the owner as __destroy_client() dereferences it, a NULL dereference in remove_blocked_locks(). On a node exporting NFS to the fleet this is a kernel oops in the server, taking mounts down across every client that depends on it. The fix holds cl_lock across the walk, taking a reference and unhashing each owner first.

Who can reach it

Local to the NFS server host: a race between DESTROY_CLIENTID-driven teardown and the per-net laundromat reaping blocked locks. Ordinary NFSv4 client churn with blocked locks outstanding is enough; no special privilege on the server is described.

What to do

Update the NFS server host to a stable kernel carrying the fix; four backport commits are linked on the record. nfsd is in-kernel, so this is a reboot of the server node with mounts stalled or failed over. Batch with the other nfsd lifetime fixes published the same day rather than taking separate windows.

References

Related entries

• Linux nfsd: copy-notify stateid freed while still discoverable, a use-after-free on all three revoke pathsCVE-2026-89663 · Linux NFS server (nfsd, copy-notify stateids in s2s_cp_stateids / _free_cpntf_state_locked)Unscored
• Linux nfsd: POSIX ACL refs leak on every malformed NFSv4 OPEN compoundCVE-2026-89664 · Linux kernel nfsd (NFSv4 OPEN compound POSIX ACL release)Unscored
• Linux nfsd: unvalidated NFSv3 nseconds corrupts on-disk timestamps on ext4 and XFSCVE-2026-89666 · Linux kernel nfsd (NFSv3 SETATTR/CREATE timestamp validation)Unscored
• Linux nfsd: copy-notify stateid published before initialisation, freeable by a racing OFFLOAD_CANCELCVE-2026-89669 · Linux kernel nfsd (NFSv4.2 COPY_NOTIFY stateid)Unscored
• Linux nfsd: localio cmpxchg retry runs outside RCU, bumping a refcount on recycled memoryCVE-2026-89670 · Linux kernel nfsd (localio nfsd_open_local_fh)Unscored
• Linux nfsd: NFSACL SETACL ignores the request mask and silently deletes the omitted ACLCVE-2026-89671 · Linux kernel nfsd (NFSACL v2/v3 SETACL mask handling)Unscored