---
id: CVE-2026-89658
title: 'NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

  nfs40_clean_admin_revoked() takes a stateid reference under
  clp->cl_lock, drops nn->client_loc…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d688d8585e6bea5e4e37f7497feea93b6b0a469c <
    0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519
  - >-
    Linux >= d688d8585e6bea5e4e37f7497feea93b6b0a469c <
    b413ec5b23e3445dc9c4f273116078e2d4747626
  - >-
    Linux >= d688d8585e6bea5e4e37f7497feea93b6b0a469c <
    81cf7f1413862f87b078920c838460a6a88aa030
  - >-
    Linux >= d688d8585e6bea5e4e37f7497feea93b6b0a469c <
    7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55
  - Linux 6.9
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:29.852Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89658'
references:
  - url: 'https://git.kernel.org/stable/c/0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519'
  - url: 'https://git.kernel.org/stable/c/b413ec5b23e3445dc9c4f273116078e2d4747626'
  - url: 'https://git.kernel.org/stable/c/81cf7f1413862f87b078920c838460a6a88aa030'
  - url: 'https://git.kernel.org/stable/c/7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89658.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89658'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532130'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89658'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89658'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89658.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00617
epssPercentile: 0.49346
scores:
  cna: 9.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

nfs40_clean_admin_revoked() takes a stateid reference under
clp->cl_lock, drops nn->client_lock, and calls
nfsd4_drop_revoked_stid(), which dereferences the stateid's client
through s->sc_client->cl_lock.  The stateid reference does not pin the
client, so a teardown racing the dropped lock can free the client
while nfsd4_drop_revoked_stid() is still using it.

This cleanup runs from the laundromat, so a periodic sweep can race
force_expire_client() driven by a write to the clients/<id>/ctl file.

Skip a client that is already expiring and otherwise pin it with
cl_rpc_users under client_lock before dropping the lock, matching
nfsd4_revoke_states().

## Affected

- `Linux >= d688d8585e6bea5e4e37f7497feea93b6b0a469c < 0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519`
- `Linux >= d688d8585e6bea5e4e37f7497feea93b6b0a469c < b413ec5b23e3445dc9c4f273116078e2d4747626`
- `Linux >= d688d8585e6bea5e4e37f7497feea93b6b0a469c < 81cf7f1413862f87b078920c838460a6a88aa030`
- `Linux >= d688d8585e6bea5e4e37f7497feea93b6b0a469c < 7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89658.json)