CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved:

nfsd: drop the stateid, not the stateowner, on seqid op replay retry

In nfs4 preprocess seqid op() the stateid is obtained from nfsd4 lookup stateid(), which holds a reference on the nfs4 stid (sc count) but takes no reference on the stateowner. openlockstateid() merely casts that stid and likewise takes no reference.

When nfsd4 cstate assign replay() returns -EAGAIN (the replay owner is being torn down, RP UNHASHED) it has not taken a stateowner reference on that path. The error handling nevertheless called nfs4 put stateowner(stp->st stateowner), dropping an so count reference the function never acquired -- risking a stateowner refcount underflow and use-after-free -- while leaking the sc count reference held on the stid. The leaked stid reference can also stall a concurrent nfsd4 close open stateid() waiting for sc count to drop.

Drop the reference actually held -- the stid -- before retrying. The stateowner stays alive through the reference held by the stid. This mirrors the open path in nfsd4 process open1(), where the put balances a reference that path explicitly holds on the stateowner.