# CVE-2026-89660

## Summary

- **CVE ID:** CVE-2026-89660
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 13, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during admin state revocation

A stateid holds only a bare pointer to its nfs4_client; a stateid
reference does not pin it.  The client survives only because
__destroy_client() drains its stateids before free_client() runs.

nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(),
which dereferences the client to revoke a stateid and read
clp->cl_minorversion.  A teardown racing the dropped lock can free
the client first.

Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and
EXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero.
force_expire_client() ignores it: once its wait for cl_rpc_users to
reach zero has passed, a later pin goes unnoticed.

Under client_lock, skip a client whose cl_time is already zero --
force_expire_client() clears it there before waiting -- otherwise pin
cl_rpc_users before dropping the lock.  The walk then either sees the
expiry and skips, or pins in time for that wait to cover the revoke.

## Affected Products

- Linux — Linux (1c13bf9f2e3cd5a59ef988c6c5a49fe0f02bcdfc)
- Linux — Linux (6.9)
- Linux — Linux (0)
- Linux — Linux (6.18.51)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/549bd9868e9d77b07ea94870940d64342829c6ad)
- [CNA](https://git.kernel.org/stable/c/bf1f948691523282cc4905bc6cd325e0c0b49e6a)
- [CNA](https://git.kernel.org/stable/c/e270e5a0778e5bff852c8862ce9576ce70359393)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.59%
- **EPSS Percentile:** 46.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._