CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during admin state revocation

A stateid holds only a bare pointer to its nfs4_client; a stateid

reference does not pin it.  The client survives only because

_destroyclient() drains its stateids before free_client() runs.

nfsd4revokestates() drops nn->clientlock across revokeone_stid(),

which dereferences the client to revoke a stateid and read

clp->cl_minorversion.  A teardown racing the dropped lock can free

the client first.

Pinning clrpcusers under clientlock blocks the DESTROYCLIENTID and

EXCHANGEID teardown, which refuses while clrpc_users is non-zero.

forceexpireclient() ignores it: once its wait for clrpcusers to

reach zero has passed, a later pin goes unnoticed.

Under clientlock, skip a client whose cltime is already zero --

forceexpireclient() clears it there before waiting -- otherwise pin

clrpcusers before dropping the lock.  The walk then either sees the

expiry and skips, or pins in time for that wait to cover the revoke.