CVE-2026-89703nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
- 9.8CriticalCVSS base score
- 0.62%Exploitation in 30 daysEPSS · top 50% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before releasing cl_lock. revoke_delegation() uses this flag to detect whether FREE_STATEID has already processed the delegation -- without it, the freed delegation is added to cl_revoked via list_add(), producing a use-after-free when cl_revoked is later traversed in __destroy_client(). The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already sets SC_STATUS_FREED correctly. Apply the same pattern to the SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().
Timeline
ID reserved
By Linux
Published
- 38 days later
· 38 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.62% · top 50% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – < d832a0587528853d45481d1faf75d4b5d062adaf
- affected 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – < 1e4795766719ffd74b8cf0f2fde4a1350f8326bf
- affected 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – < a6d89032e5c6620d5bb44582a72555ce07bf1c2e
- affected 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – < 650d370cfbc66a96dd14d517bd704689b5bda4e5
- affected 967faa26f313a62e7bebc55d5b8122eaee43b929
- affected 6.11.6 – < 6.12
- affected 6.12
- unaffected < 6.12
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References4
- https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf (opens in a new tab)
- https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf (opens in a new tab)
- https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e (opens in a new tab)
- https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76615 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89703)Record last updated .