---
id: CVE-2026-89660
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSD: Prevent client use-after-free during admin state revocation

  A stateid holds only a bare pointer to its nfs4_client; a stateid
  reference does not pin it
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSD: Prevent client use-after-free during admin state revocation

  A stateid holds only a bare pointer to its nfs4_client; a stateid
  reference does not pin it.  The cli…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1c13bf9f2e3cd5a59ef988c6c5a49fe0f02bcdfc <
    e1ba4d3c5bfdca3f013b8cbc829ae2f7975d8608
  - >-
    Linux >= 1c13bf9f2e3cd5a59ef988c6c5a49fe0f02bcdfc <
    549bd9868e9d77b07ea94870940d64342829c6ad
  - >-
    Linux >= 1c13bf9f2e3cd5a59ef988c6c5a49fe0f02bcdfc <
    bf1f948691523282cc4905bc6cd325e0c0b49e6a
  - >-
    Linux >= 1c13bf9f2e3cd5a59ef988c6c5a49fe0f02bcdfc <
    e270e5a0778e5bff852c8862ce9576ce70359393
  - Linux 6.9
published: '2026-09-11'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:24.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89660'
references:
  - url: 'https://git.kernel.org/stable/c/549bd9868e9d77b07ea94870940d64342829c6ad'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bf1f948691523282cc4905bc6cd325e0c0b49e6a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e1ba4d3c5bfdca3f013b8cbc829ae2f7975d8608'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e270e5a0778e5bff852c8862ce9576ce70359393'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89660.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89660'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532092'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89660'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89660'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89660.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00608
epssPercentile: 0.47776
scores:
  nvd: 9.8
  cna: 9.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during admin state revocation

A stateid holds only a bare pointer to its nfs4_client; a stateid
reference does not pin it.  The client survives only because
__destroy_client() drains its stateids before free_client() runs.

nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(),
which dereferences the client to revoke a stateid and read
clp->cl_minorversion.  A teardown racing the dropped lock can free
the client first.

Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and
EXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero.
force_expire_client() ignores it: once its wait for cl_rpc_users to
reach zero has passed, a later pin goes unnoticed.

Under client_lock, skip a client whose cl_time is already zero --
force_expire_client() clears it there before waiting -- otherwise pin
cl_rpc_users before dropping the lock.  The walk then either sees the
expiry and skips, or pins in time for that wait to cover the revoke.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89660.json)