SEPTEMBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-89658

CRITICAL · CVSS 9.8 EPSS 0.61%

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-13

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's NFSv4.0 implementation, specifically in the handling of client state during revoked-state cleanup, which can lead to a use-after-free condition. This flaw may allow an attacker to exploit race conditions, potentially leading to system instability or unauthorized access. Organizations using Linux-based systems that rely on NFSv4.0 should prioritize patching this vulnerability to mitigate risks associated with client state management.

CVE
CVE-2026-89658
Severity
CRITICAL
CVSS
9.8
EPSS
0.61%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4_drop_revoked_stid() is still using it. This cleanup runs from the laundromat, so a periodic sweep can race force_expire_client() driven by a write to the clients/<id>/ctl file. Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().