Linux nfsd: seqid_op replay retry drops a stateowner reference it never took

Impact

When nfsd4_cstate_assign_replay() returns -EAGAIN because the replay owner is being torn down, the error path called nfs4_put_stateowner() on a so_count reference it never acquired, while leaking the sc_count reference it did hold on the stid. That risks a stateowner refcount underflow and use-after-free in the NFS server, and the leaked stid reference can stall a concurrent nfsd4_close_open_stateid() waiting for the count to drop - a hung CLOSE that looks like a storage stall to every client. Driving it requires hitting the narrow window where a replay owner is unhashed, which makes it hard to aim but reachable from ordinary client traffic on a busy export.

Who can reach it

Any NFSv4 client permitted to mount the export and issue seqid-bearing operations (OPEN/LOCK/CLOSE) concurrently. Standard client authentication only.

What to do

Update the NFS server kernel to include one of the linked stable commits and reboot; the fix drops the stid reference instead of the stateowner. No runtime mitigation exists - nfsd is in-kernel, so restarting the service does not carry the fix.

References

Related entries

• Linux nfsd: session slot shrinker frees the slot in use, corrupting the slab with reply dataCVE-2026-89689 · Linux NFS server (nfsd4_sequence session slot shrinker, free_session_slots)Critical
• Linux nfsd: fh_verify tracepoints size the server address slot wrongly, writing past the trace bufferCVE-2026-89702 · Linux NFS server (nfsd_fh_verify tracepoints, server sockaddr slot sizing)Critical
• Linux nfsd: FREE_STATEID on an admin-revoked delegation leaves it on cl_revoked as freed memoryCVE-2026-89703 · Linux NFS server (nfsd4_drop_revoked_stid, SC_STATUS_FREED on delegations)Critical
• Linux nfsd: use-after-free on cl_cb_session when a session is destroyed with a callback in flightCVE-2026-89708 · Linux NFS server (nfsd callback client, cl_cb_session lifetime on DESTROY_SESSION)Critical
• Intel Data Center Manager SDK (reference UI): The DCM SDK's reference UI allows an unauthenticated remote attackerCVE-2018-3679 · Intel Data Center Manager SDK (reference UI)Critical
• BeeGFS (beegfs-ctl / metadata server): Authentication bypass by talking directly to a BeeGFS metadata server. BeeGFS isCVE-2019-15897 · BeeGFS (beegfs-ctl / metadata server)Critical