{"id":"CVE-2026-89703","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-89703","summary":"nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations\n\nnfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked\ndelegations but does not set SC_STATUS_FREED before releasing cl_lock.\nrevoke_delegation() uses this flag to detect whether FREE_STATEID has\nalready processed the delegation -- without it, the freed delegation is\nadded to cl_revoked via list_add(), producing a use-after-free when\ncl_revoked is later traversed in __destroy_client().\n\nThe SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already\nsets SC_STATUS_FREED correctly. Apply the same pattern to the\nSC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().","published":"2026-09-11T19:46:20.280Z","modified":"2026-09-14T03:46:26.509224665Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.12.109"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89703.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89703"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-14T03:46:26.509224665Z"}}