CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during admin state revocation

A stateid holds only a bare pointer to its nfs4 client; a stateid reference does not pin it. The client survives only because destroy client() drains its stateids before free client() runs.

nfsd4 revoke states() drops nn->client lock across revoke one stid(), which dereferences the client to revoke a stateid and read clp->cl minorversion. A teardown racing the dropped lock can free the client first.

Pinning cl rpc users under client lock blocks the DESTROY CLIENTID and EXCHANGE ID teardown, which refuses while cl rpc users is non-zero. force expire client() ignores it: once its wait for cl rpc users to reach zero has passed, a later pin goes unnoticed.

Under client lock, skip a client whose cl time is already zero -- force expire client() clears it there before waiting -- otherwise pin cl rpc users before dropping the lock. The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.