{"id":"CVE-2026-89659","state":"PUBLISHED","title":"NFSD: Prevent client use-after-free during delegation revoke","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during delegation revoke\n\nA delegation stateid holds only a bare pointer to its owning\nnfs4_client and does not keep it alive.  The client survives its\nstateids only because __destroy_client() drains cl_delegations and\ncl_revoked before free_client() runs.\n\nnfs4_laundromat() breaks that invariant: it unhashes an\nexpired delegation from cl_delegations, drops deleg_lock, then\nrevoke_delegation() relinks it onto cl_revoked under cl_lock.  In that\nwindow the delegation is on neither list, so client_has_state() can\nreport no remaining state.\n\nEvery teardown path first requires cl_rpc_users to be zero, but\nthe laundromat holds no such reference.  A client whose recalled\ndelegation has just timed out can therefore reach free_client()\nwhile revoke_delegation() is still about to dereference cl_lock,\na use-after-free.\n\nPin the client with cl_rpc_users across the revoke so teardown blocks\nuntil it completes, then reap the delegation from cl_revoked.  A client\nalready expiring reaps its own, so skip it and leave the delegation on\ndel_recall_lru.","publishedAt":"2026-09-11T19:45:47.587Z","updatedAt":"2026-10-30T12:32:34.470Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"2f9a200c0ea5b214609b8cea2b6666458bcb54cd","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"94f0c73797c30a35812ffb32d11b8737d245c405","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"0dd276b1324a5e08e83c6f675919946c9f0d61c9","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"4683ca76b3b7e5808338491c6eb3c20e6b4894d5","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/netns.h","fs/nfsd/nfs4state.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.10","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.111","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/netns.h","fs/nfsd/nfs4state.c"]}],"references":["https://git.kernel.org/stable/c/2f9a200c0ea5b214609b8cea2b6666458bcb54cd","https://git.kernel.org/stable/c/94f0c73797c30a35812ffb32d11b8737d245c405","https://git.kernel.org/stable/c/0dd276b1324a5e08e83c6f675919946c9f0d61c9","https://git.kernel.org/stable/c/3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3","https://git.kernel.org/stable/c/2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56","https://git.kernel.org/stable/c/4683ca76b3b7e5808338491c6eb3c20e6b4894d5"],"weaknesses":[],"ingestedAt":"2026-10-30T12:52:04.348Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89659.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89659","state":"PUBLISHED","datePublished":"2026-09-11T19:45:47.587Z","dateUpdated":"2026-10-30T12:32:34.470Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.744Z"},"containers":{"cna":{"title":"NFSD: Prevent client use-after-free during delegation revoke","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during delegation revoke\n\nA delegation stateid holds only a bare pointer to its owning\nnfs4_client and does not keep it alive.  The client survives its\nstateids only because __destroy_client() drains cl_delegations and\ncl_revoked before free_client() runs.\n\nnfs4_laundromat() breaks that invariant: it unhashes an\nexpired delegation from cl_delegations, drops deleg_lock, then\nrevoke_delegation() relinks it onto cl_revoked under cl_lock.  In that\nwindow the delegation is on neither list, so client_has_state() can\nreport no remaining state.\n\nEvery teardown path first requires cl_rpc_users to be zero, but\nthe laundromat holds no such reference.  A client whose recalled\ndelegation has just timed out can therefore reach free_client()\nwhile revoke_delegation() is still about to dereference cl_lock,\na use-after-free.\n\nPin the client with cl_rpc_users across the revoke so teardown blocks\nuntil it completes, then reap the delegation from cl_revoked.  A client\nalready expiring reaps its own, so skip it and leave the delegation on\ndel_recall_lru."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"2f9a200c0ea5b214609b8cea2b6666458bcb54cd","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"94f0c73797c30a35812ffb32d11b8737d245c405","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"0dd276b1324a5e08e83c6f675919946c9f0d61c9","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56","versionType":"git"},{"version":"3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54","status":"affected","lessThan":"4683ca76b3b7e5808338491c6eb3c20e6b4894d5","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/netns.h","fs/nfsd/nfs4state.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.10","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.111","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/netns.h","fs/nfsd/nfs4state.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2f9a200c0ea5b214609b8cea2b6666458bcb54cd"},{"url":"https://git.kernel.org/stable/c/94f0c73797c30a35812ffb32d11b8737d245c405"},{"url":"https://git.kernel.org/stable/c/0dd276b1324a5e08e83c6f675919946c9f0d61c9"},{"url":"https://git.kernel.org/stable/c/3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3"},{"url":"https://git.kernel.org/stable/c/2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56"},{"url":"https://git.kernel.org/stable/c/4683ca76b3b7e5808338491c6eb3c20e6b4894d5"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in nfsd nfs4_laundromat()/revoke_delegation() in fs/nfsd/nfs4state.c. A remote NFSv4 client reaches it over TCP/2049 by OPEN to obtain a delegation, a conflicting OPEN to force CB_RECALL, then DESTROY_CLIENTID or CREATE_SESSION replacement while the laundromat revokes.\nAC:L - The attacker controls both sides: it creates the recalled delegation, learns FATTR4_LEASE_TIME, and issues DESTROY_CLIENTID or same-name CREATE_SESSION/SETCLIENTID_CONFIRM while laundromat unhashes. Many recalled delegations widen the unhash-to-revoke window, and the sequence is retryable.\nPR:N - Default AUTH_SYS nfsd exports do no cryptographic authentication; any host allowed by the export ACL can EXCHANGE_ID/SETCLIENTID, OPEN to get a delegation, and DESTROY_CLIENTID. No local account or capability on the NFS server is required.\nUI:N - The attacking NFS client performs the full sequence itself (delegation, recall, teardown). No local user or administrator action on the NFS server is required at attack time.\nS:U - The use-after-free corrupts the nfs4_client object in the host kernel's nfsd state tables. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - revoke_delegation() and nfs4_put_stid() dereference sc_client (cl_lock, cl_revoked, cl_stateids) after free_client() kmem_cache_free's the mergeable client_slab object (KMEM_CACHE flags 0), a UAF the attacker can reallocate via EXCHANGE_ID to disclose kernel memory.\nI:H - The UAF writes include spin_lock/unlock of freed cl_lock, list_add onto cl_revoked, and refcount_dec_and_lock in nfs4_put_stid on a reclaimable nfs4_client, enabling heap corruption and control-flow hijack.\nA:H - Use-after-free of nfs4_client in an nfsd/laundromat thread oopses or panics the NFS server even without full exploitation, and the attacker can repeat the RPC sequence to deny service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:32:34.470Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89659","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:25:33.821505Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:26:47.601Z"}}]}}}