CVE-2026-89658: Linux Kernel NFSv4.0 Use-After-Free Vulnerability

CVE-2026-89658 Overview

CVE-2026-89658 is a use-after-free vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw resides in nfs40_clean_admin_revoked(), which handles NFSv4.0 revoked-state cleanup from the laundromat thread. The function takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(). Because the stateid reference does not pin the client, a concurrent client teardown can free the client structure while it is still being dereferenced through s->sc_client->cl_lock. The race window opens between the laundromat's periodic sweep and force_expire_client(), which can be triggered by a write to the clients/<id>/ctl file.

Critical Impact
Network-adjacent attackers or local users with write access to NFSD control files can trigger a use-after-free in kernel memory, enabling denial of service and potentially kernel-level code execution.

Affected Products

Linux kernel builds with NFSD (NFS server) enabled
Systems serving NFSv4.0 with administrative revocation paths active
Distributions shipping affected kernel versions prior to the upstream fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89658 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89658

Vulnerability Analysis

The vulnerability is a classic use-after-free triggered by a race condition between two NFSD cleanup paths. The nfs40_clean_admin_revoked() routine acquires a stateid reference while holding clp->cl_lock, then releases nn->client_lock before invoking nfsd4_drop_revoked_stid(). That callee dereferences the client pointer stored inside the stateid via s->sc_client->cl_lock.

The stateid reference itself does not increment the client's reference count. As a result, once the outer lock is dropped, nothing prevents the client structure from being torn down. A parallel teardown initiated by force_expire_client(), driven by an administrative write to /proc/fs/nfsd/clients/<id>/ctl, can complete during that window and release the client memory.

Root Cause

The root cause is missing client pinning across a lock-dropping boundary. The laundromat-driven cleanup path assumed that holding a stateid reference was sufficient to keep the associated client alive, but the two objects have independent lifetimes. The fix, mirroring nfsd4_revoke_states(), skips any client that is already expiring and otherwise pins the client with cl_rpc_users while client_lock is still held. This guarantees the client remains valid throughout the subsequent nfsd4_drop_revoked_stid() call.

Attack Vector

Exploitation requires the ability to influence NFSD state such that the laundromat performs revoked-state cleanup while a client expiration is forced in parallel. An authenticated NFS client can accumulate revoked NFSv4.0 state, while an administrator or local user with access to the NFSD control files can trigger force_expire_client() by writing to clients/<id>/ctl. Successful exploitation corrupts kernel memory, producing denial of service. Depending on allocator behavior, use-after-free primitives in kernel memory can be leveraged toward privilege escalation. Refer to the upstream fix commits for the exact code paths: kernel commit 0ae0d2b5c5a1, kernel commit 7b4f8a1586c4, kernel commit 81cf7f141386, and kernel commit b413ec5b23e3.

No verified public proof-of-concept exploit code is available for this vulnerability.

Detection Methods for CVE-2026-89658

Indicators of Compromise

Kernel oops or panic messages referencing nfs40_clean_admin_revoked, nfsd4_drop_revoked_stid, or sc_client dereferences
KASAN reports flagging use-after-free in the NFSD subsystem on systems serving NFSv4.0
Unexplained NFSD service restarts correlated with writes to /proc/fs/nfsd/clients/<id>/ctl

Detection Strategies

Monitor dmesg and journalctl -k for NFSD stack traces involving stateid or client cleanup functions
Deploy kernels with KASAN or KFENCE enabled in test environments to surface race-induced memory corruption
Correlate NFSD administrative control-file writes with subsequent kernel warnings within the same time window

Monitoring Recommendations

Audit write access to /proc/fs/nfsd/clients/ and alert on unexpected ctl file interactions
Track NFSv4.0 client expiration and revocation counters exposed via /proc/fs/nfsd/ for anomalous spikes
Forward kernel logs to a centralized analytics platform to identify recurring NFSD faults across the fleet

How to Mitigate CVE-2026-89658

Immediate Actions Required

Apply the upstream Linux kernel patches listed in the vendor references and reboot affected NFS servers
Restrict administrative access to /proc/fs/nfsd/clients/<id>/ctl to trusted operators only
Limit NFSv4.0 exposure on untrusted networks until patched kernels are deployed

Patch Information

The fix pins the client with cl_rpc_users under client_lock before dropping the lock and skips clients that are already expiring, matching the pattern in nfsd4_revoke_states(). The corrected code is available in the stable kernel commits: 0ae0d2b5c5a1, 7b4f8a1586c4, 81cf7f141386, and b413ec5b23e3. Rebuild and deploy kernels containing these commits, or install vendor-supplied kernel updates that backport the fix.

Workarounds

Disable NFSv4.0 support where NFSv4.1 or later can be used exclusively, reducing exposure to the revoked-state cleanup path
Enforce strict filesystem permissions on the NFSD procfs interface so only root-owned management tooling can write to client control files
Where feasible, stop the NFS server (nfs-server.service) on hosts that do not require it until patched kernels are installed

bash

# Verify running kernel and NFSD status before applying updates
uname -r
systemctl status nfs-server

# Restrict access to the NFSD control interface
ls -l /proc/fs/nfsd/clients/

# Apply distribution kernel updates (example: Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f2-)
sudo reboot