CVE-2026-89659

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during delegation revoke

A delegation stateid holds only a bare pointer to its owning nfs4 client and does not keep it alive. The client survives its stateids only because destroy client() drains cl delegations and cl revoked before free client() runs.

nfs4 laundromat() breaks that invariant: it unhashes an expired delegation from cl delegations, drops deleg lock, then revoke delegation() relinks it onto cl revoked under cl lock. In that window the delegation is on neither list, so client has state() can report no remaining state.

Every teardown path first requires cl rpc users to be zero, but the laundromat holds no such reference. A client whose recalled delegation has just timed out can therefore reach free client() while revoke delegation() is still about to dereference cl lock, a use-after-free.

Pin the client with cl rpc users across the revoke so teardown blocks until it completes, then reap the delegation from cl revoked. A client already expiring reaps its own, so skip it and leave the delegation on del recall lru.