CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved:

nfsd: revoke copy-notify stateids before dropping their reference

Copy-notify stateids live in the s2s cp stateids IDR and on their parent stid's sc cp list, pinned by a single membership reference. free cpntf state locked() only unlinks an entry once its refcount reaches zero, so any revoke path that runs while a concurrent find cpntf state()/manage cpntf state() holder has elevated cs count drops the reference without unlinking, leaving the entry discoverable with its membership reference already consumed. A second revoke or a laundromat tick then frees it while the reader still holds the pointer -- a KASAN-detectable use-after-free at the reader's nfs4 put cpntf state().

This affected all three revoke paths:

Add revoke cpntf state locked(), which unhashes the entry from the IDR and sc cp list first (deferring the final free to any holder), and use it from all three revoke paths. The drain now walks with list for each entry safe() and revokes each entry unconditionally, so it terminates in one pass per entry regardless of cs count. The unhash is gated on !list empty(&cps->cp list); the idr remove() gate matters because idr alloc cyclic() may have recycled the so id by then. Keep free cpntf state locked() for the reference-holder put path only, where a concurrent revoke may already have unlinked the entry (its list del init() then a no-op).