CVE-2026-89659

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during delegation revoke

A delegation stateid holds only a bare pointer to its owning

nfs4_client and does not keep it alive.  The client survives its

stateids only because _destroyclient() drains cl_delegations and

clrevoked before freeclient() runs.

nfs4_laundromat() breaks that invariant: it unhashes an

expired delegation from cldelegations, drops deleglock, then

revokedelegation() relinks it onto clrevoked under cl_lock.  In that

window the delegation is on neither list, so clienthasstate() can

report no remaining state.

Every teardown path first requires clrpcusers to be zero, but

the laundromat holds no such reference.  A client whose recalled

delegation has just timed out can therefore reach free_client()

while revokedelegation() is still about to dereference cllock,

a use-after-free.

Pin the client with clrpcusers across the revoke so teardown blocks

until it completes, then reap the delegation from cl_revoked.  A client

already expiring reaps its own, so skip it and leave the delegation on

delrecalllru.