CVE-2026-89658

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

nfs40 clean admin revoked() takes a stateid reference under clp->cl lock, drops nn->client lock, and calls nfsd4 drop revoked stid(), which dereferences the stateid's client through s->sc client->cl lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4 drop revoked stid() is still using it.

This cleanup runs from the laundromat, so a periodic sweep can race force expire client() driven by a write to the clients//ctl file.

Skip a client that is already expiring and otherwise pin it with cl rpc users under client lock before dropping the lock, matching nfsd4 revoke states().