CVE-2026-89703: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89703 Overview

CVE-2026-89703 is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd4_drop_revoked_stid(), which handles FREE_STATEID requests for admin-revoked delegations. The function fails to set the SC_STATUS_FREED flag before releasing cl_lock. As a result, revoke_delegation() cannot detect that the delegation has already been freed and re-inserts it into the cl_revoked list. When __destroy_client() later traverses cl_revoked, it dereferences freed memory.

Critical Impact
A remote attacker able to interact with the NFS server can trigger a use-after-free in kernel memory, potentially enabling denial of service or kernel-level code execution.

Affected Products

Linux kernel (upstream nfsd subsystem)
Linux distributions shipping affected stable kernels prior to the fix commits
NFSv4 server deployments handling delegation state

Discovery Timeline

2026-09-11 - CVE-2026-89703 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89703

Vulnerability Analysis

The vulnerability affects the NFSv4 state management logic in the Linux kernel's nfsd server. NFSv4 delegations allow clients to cache file state locally, and the server tracks each delegation's lifecycle through stateid objects protected by per-client locks (cl_lock). When an administrator revokes a delegation, the server must coordinate between the FREE_STATEID operation initiated by clients and internal revocation paths.

The nfsd4_free_stateid() function correctly sets SC_STATUS_FREED on the SC_STATUS_REVOKED code path, signaling that the stateid has been released. The parallel path in nfsd4_drop_revoked_stid(), which handles the SC_STATUS_ADMIN_REVOKED case, does not perform this update before releasing cl_lock. This inconsistency creates a race window where revoke_delegation() observes a stale status and assumes the delegation still requires cleanup.

Root Cause

The root cause is a missing state flag update in the admin-revoked delegation cleanup path. Without SC_STATUS_FREED being set, revoke_delegation() executes list_add() against a delegation object that has already been freed by the concurrent FREE_STATEID handler. The freed object then remains linked in cl_revoked until __destroy_client() walks the list and dereferences the freed memory, resulting in a classic use-after-free condition.

Attack Vector

The vulnerability is reachable over the network by any NFSv4 client that can issue FREE_STATEID operations against an admin-revoked delegation on a vulnerable NFS server. Because NFSv4 state operations do not require additional user interaction beyond an established NFS session, an attacker with access to an exported NFS mount can drive the race. Successful exploitation corrupts kernel heap structures traversed during client teardown, which can cascade into kernel memory corruption when the affected client state is destroyed.

No public proof-of-concept exploit code is available. Refer to the upstream kernel commits for the technical fix: Kernel Git Commit 1e47957, Kernel Git Commit 650d370, Kernel Git Commit a6d8903, and Kernel Git Commit d832a05.

Detection Methods for CVE-2026-89703

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nfsd, revoke_delegation, __destroy_client, or cl_revoked list traversal.
KASAN reports flagging use-after-free within the nfsd module on servers exporting NFSv4 shares.
Repeated NFSv4 FREE_STATEID operations targeting admin-revoked delegations in server logs.

Detection Strategies

Monitor kernel ring buffer output (dmesg, journalctl -k) for stack traces originating in nfsd4_drop_revoked_stid, revoke_delegation, or __destroy_client.
Correlate NFS server crash events with active NFSv4 client sessions that recently issued delegation-related operations.
Track kernel package versions across NFS servers to identify hosts running vulnerable builds that predate the upstream fix commits.

Monitoring Recommendations

Enable and review kernel crash dumps (kdump) on NFS servers to preserve forensic evidence of use-after-free conditions.
Aggregate NFSv4 operation telemetry to detect abnormal patterns of FREE_STATEID calls following administrative delegation revocation.
Alert on unexpected NFS service restarts or client disconnect storms that may indicate exploitation attempts.

How to Mitigate CVE-2026-89703

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix commits 1e47957, 650d370, a6d8903, and d832a05 as soon as vendor-supplied packages are available.
Inventory all Linux hosts running nfsd and prioritize patching for internet-adjacent or multi-tenant NFS servers.
Restrict NFSv4 exports to trusted network segments using firewall rules and exports(5) host restrictions until patches are deployed.

Patch Information

The fix aligns nfsd4_drop_revoked_stid() with the existing pattern in nfsd4_free_stateid() by setting SC_STATUS_FREED on the admin-revoked path before releasing cl_lock. Distribution-specific patched kernel versions should be obtained from your Linux vendor's security advisories. Reference the upstream commits: 1e47957, 650d370, a6d8903, and d832a05.

Workarounds

Limit NFS server exposure by binding nfsd to internal interfaces and blocking TCP/UDP port 2049 at perimeter firewalls.
Disable NFSv4 delegations on affected servers by setting the leases export option or tuning /proc/sys/fs/leases-enable to reduce the delegation attack surface.
Segment NFS clients into trust zones and enforce strong authentication (Kerberos sec=krb5p) to limit which principals can trigger delegation state operations.

bash

# Configuration example: disable NFSv4 delegations as a temporary workaround
echo 0 > /proc/sys/fs/leases-enable
systemctl restart nfs-server

# Verify running kernel version against vendor advisory
uname -r