CVE-2026-89703

A use-after-free exists in the Linux kernel's NFS server (nfsd) subsystem, in nfsd4_drop_revoked_stid(), which processes FREE_STATEID operations for admin-revoked NFSv4 delegations. The function fails to set the SC_STATUS_FREED flag before releasing the client lock, so the already-freed delegation structure is re-added to the client's cl_revoked list; when that list is later traversed in __destroy_client(), the kernel dereferences freed memory. An attacker who can act as an NFSv4 client to an affected server (i.e., reach the NFS service and issue stateid operations against an admin-revoked delegation) could trigger this, potentially crashing the kernel or corrupting kernel memory with confidentiality, integrity, and availability impact, per the critical 9.8 CVSS score. Systems affected are Linux machines exporting filesystems via kernel nfsd with NFSv4 delegations in use. No public proof of concept is known and the flaw is not listed in CISA's KEV, so exploitation is presumed absent at this time.

What to do: Apply kernel updates from your distribution as soon as a build containing this nfsd fix is released, and reboot NFS servers to load the patched kernel. Until then, firewall TCP/2049 so only trusted client networks can reach nfsd, and verify that no NFS exports are exposed to the internet — internet-facing NFS should be eliminated regardless of this bug. Check for unexplained kernel oopses or crashes on NFS servers handling delegation revocations, as these would be indicators worth investigating.