CVE-2026-89658

The Linux kernel's NFS server daemon (NFSD) contains a use-after-free in NFSv4.0 revoked-state cleanup: nfs40_clean_admin_revoked() takes a stateid reference but does not pin the owning client, so after dropping the client lock the client can be freed while nfsd4_drop_revoked_stid() still dereferences it. The race is triggered when the periodic laundromat sweep runs concurrently with a force_expire_client() operation initiated by an administrator writing to the nfsd clients/ctl control file, with attacker-controlled client activity influencing state churn and timing. Successful exploitation corrupts kernel memory on the NFS server, which in the worst case yields kernel-level code execution, though the CVSS 9.8 rating overstates practical exploitability since a tight race must be won and admin-triggered expiry is involved. Any system running the kernel's nfsd with NFSv4.0 exports and revoked-state reclamation is affected; the fix pins the client with cl_rpc_users or skips already-expiring clients. No public proof of concept is known and the flaw is not in CISA's KEV catalog.

What to do: Patch to a kernel release containing the nfs40_clean_admin_revoked() fix once your distribution ships it, prioritizing hosts running nfsd with NFSv4.0 exports. Until then, firewall TCP/2049 to trusted clients only and scan your perimeter for exposed NFS. As an operational mitigation, avoid writing to the nfsd clients/ctl control file (force-expiring clients) during periods of heavy client churn, since that is the racing trigger.