CVE-2026-89661

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent post-shutdown use-after-free in unlock filesystem

Writing a filesystem path to /proc/fs/nfsd/unlock filesystem runs nfsd4 cancel copy by sb() before nfsd mutex is held and before the handler confirms that nn->nfsd serv is set. Once nfsd has shut down, nfs4 state destroy net() has freed nn->conf id hashtbl but left the pointer intact, so the cancel helper iterates freed slab memory as an array of struct list head and then dereferences a bogus nfs4 client when it takes clp->async lock. A local administrator holding CAP SYS ADMIN can reach this use-after-free by stopping the server and then writing to unlock filesystem; KASAN reports a slab-use-after-free read in nfsd4 cancel copy by sb().

nfsd4 revoke states() walks the same state tables and for that reason already runs only under nfsd mutex with nn->nfsd serv confirmed present. Move the async COPY cancel into that protected section so every NFSv4 state-table walker on this path observes a running server. Async copies exist only while the server runs, so gating the cancel on nn->nfsd serv loses nothing.