---
id: CVE-2026-89703
title: 'nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

  nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked
  delegations but does not set SC_S…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a <
    d832a0587528853d45481d1faf75d4b5d062adaf
  - >-
    Linux >= 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a <
    1e4795766719ffd74b8cf0f2fde4a1350f8326bf
  - >-
    Linux >= 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a <
    a6d89032e5c6620d5bb44582a72555ce07bf1c2e
  - >-
    Linux >= 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a <
    650d370cfbc66a96dd14d517bd704689b5bda4e5
  - Linux 967faa26f313a62e7bebc55d5b8122eaee43b929
  - Linux >= 6.11.6 < 6.12
  - Linux 6.12
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:16.319Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89703'
references:
  - url: 'https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf'
  - url: 'https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf'
  - url: 'https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e'
  - url: 'https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89703.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89703'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532470'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89703'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89703'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89703.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00617
epssPercentile: 0.49346
scores:
  cna: 9.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.472Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked
delegations but does not set SC_STATUS_FREED before releasing cl_lock.
revoke_delegation() uses this flag to detect whether FREE_STATEID has
already processed the delegation -- without it, the freed delegation is
added to cl_revoked via list_add(), producing a use-after-free when
cl_revoked is later traversed in __destroy_client().

The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already
sets SC_STATUS_FREED correctly. Apply the same pattern to the
SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().

## Affected

- `Linux >= 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a < d832a0587528853d45481d1faf75d4b5d062adaf`
- `Linux >= 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a < 1e4795766719ffd74b8cf0f2fde4a1350f8326bf`
- `Linux >= 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a < a6d89032e5c6620d5bb44582a72555ce07bf1c2e`
- `Linux >= 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a < 650d370cfbc66a96dd14d517bd704689b5bda4e5`
- `Linux 967faa26f313a62e7bebc55d5b8122eaee43b929`
- `Linux >= 6.11.6 < 6.12`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89703.json)