Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89658— NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： NFSD：在 NFSv4.0 状态撤销清理过程中防止客户端使用已释放内存（use-after-free） 在持有 时获取 stateid 的引用，随后释放 ，并调用 。该函数通过 解引用 stateid 所属的客户端。由于 stateid 的引用并未固定（pin）客户端，因此在锁被释放后，若客户端销毁流程（teardown）与锁释放发生竞态，可能会在 仍在使用该客户端时将其释放，从而导致使用已释放内存的问题。 该清理过程由 laundromat（内部清理机制）触发，因此

AI Predicted 5.5 Difficulty: Hard

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux d688d8585e6bea5e4e37f7497feea93b6b0a469c< 0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519 affected
d688d8585e6bea5e4e37f7497feea93b6b0a469c< b413ec5b23e3445dc9c4f273116078e2d4747626 affected
d688d8585e6bea5e4e37f7497feea93b6b0a469c< 81cf7f1413862f87b078920c838460a6a88aa030 affected
d688d8585e6bea5e4e37f7497feea93b6b0a469c< 7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55 affected
6.9 affected
< 6.9 unaffected
6.12.109≤ 6.12.* unaffected
6.18.50≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89658

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4_drop_revoked_stid() is still using it. This cleanup runs from the laundromat, so a periodic sweep can race force_expire_client() driven by a write to the clients/<id>/ctl file. Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d688d8585e6bea5e4e37f7497feea93b6b0a469c ~ 0ae0d2b5c5a1b39c0b3c15d96b32a5b0c583d519 -
Linux Linux 6.9 -

II. Public POCs for CVE-2026-89658

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89658

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89658 (4)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89491 ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
CVE-2026-89477 sctp: fix NULL deref on untransmitted RECONF completion
CVE-2026-89478 sctp: drop a chunk if its transport was removed
CVE-2026-89479 sctp: stop processing a packet once its association is deleted
CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes
CVE-2026-89482 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command
CVE-2026-89483 nvme: zero the discard fallback page
CVE-2026-89484 lockd: fix NULL dereference on lockowner allocation failure
CVE-2026-89485 lockd: pin next file across nlm_inspect_file lock-drop
CVE-2026-89486 ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop
CVE-2026-89488 openvswitch: Fix CT limit teardown use-after-free
CVE-2026-89489 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
CVE-2026-89500 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
CVE-2026-89497 orangefs: skip leading spaces before parsing client debug masks
CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure
CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails
CVE-2026-89496 ocfs2: always run deallocs on copy-on-write completion
CVE-2026-89501 ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89658

No comments yet

Leave a comment