CVE-2026-89703

In the Linux kernel, the following vulnerability has been resolved:

nfsd: set SC STATUS FREED in nfsd4 drop revoked stid for delegations

nfsd4 drop revoked stid() handles FREE STATEID for admin-revoked delegations but does not set SC STATUS FREED before releasing cl lock. revoke delegation() uses this flag to detect whether FREE STATEID has already processed the delegation -- without it, the freed delegation is added to cl revoked via list add(), producing a use-after-free when cl revoked is later traversed in destroy client().

The SC STATUS REVOKED path in nfsd4 free stateid() (line 7983) already sets SC STATUS FREED correctly. Apply the same pattern to the SC STATUS ADMIN REVOKED path in nfsd4 drop revoked stid().