CVE-2026-89706

In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().

In the Linux kernel, the BOTH_TIME_SET branch in nfsd_proc_setattr() called fh_verify() early so setattr_prepare() could inspect the dentry. This caused nfsd_setattr() to skip fh_want_write(), so notify_change() ran without a mount write reference.

A use-after-free vulnerability was found in the Linux kernel nfsd module within nfsd4_sequence(). When the session shrinker reduces se_target_maxslots below se_fchannel.maxreqs, free_session_slots() may free the slot currently being processed because it does not check seq->slotid or the NFSD4_SLOT_INUSE flag. This leads to memory corruption via writes into the freed sl_data[] buffer.

In the Linux kernel's nfsd module, nfs4_preprocess_seqid_op() on an -EAGAIN error from nfsd4_cstate_assign_replay() dropped a stateowner reference it never acquired, while leaking the stid reference. This risks a stateowner refcount underflow and use-after-free, and can stall a concurrent nfsd4_close_open_stateid(). The fix drops the stid reference before retrying.

In the Linux kernel, nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering BUG_ON. The race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall.

In the Linux kernel, the workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid.

The NFSD implementation in the Linux kernel prior to versions 5.19.17 and 6.0.2 is vulnerable to buffer overflow. A client can force the send buffer to shrink by sending an RPC message with garbage data, leading to writes beyond the allocated buffer space.

A bug was found in the Linux kernel NFSD (NFS server) module where the export reference (svc_export) was leaked when reaping open and lock stateids. The free_ol_stateid_reaplist() function freed stateids directly via ->sc_free(), bypassing the nfs4_put_stid() path that releases the export reference. As a result, the reference was never dropped, pinning the export and blocking unmount for the lifetime of the stateid.

In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.

In the Linux kernel, _nfsd_copy_file_range() sampled the writeback error cursor (dst->f_wb_err) after the copy loop instead of before it. Concurrent COMMIT or stable WRITE could advance the cursor, so the writeback error went undetected and NFSD4_COPY_F_COMMITTED was set despite the failed write.