CVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent lock owner use-after-free during client teardown

_destroyclient() releases a client's open owners, but a lock owner

whose only reference is a blocked lock (nbl) stays on

clownerstrhashtbl.  clienthasstate() does not count a bare owner,

so DESTROYCLIENTID can reach destroyclient() with such owners

present.

_destroyclient() then walks the table, calling removeblockedlocks()

on each owner without a reference.  Freeing a blocked lock drops the

owner reference held via flc_owner.  The per-net laundromat reaps

blocked locks from nn->blockedlockslru independently of client state.

The two paths share blockedlockslock only for the list splice, not

the owner's lifetime.  The laundromat therefore frees the owner as

_destroyclient() dereferences it, a NULL dereference in

removeblockedlocks().

nfsd4releaselockowner() holds a reference across the same call;

_destroyclient() does not.  Hold cl_lock across the walk, taking a

reference and unhashing each owner, then drop it before

removeblockedlocks() and nfs4putstateowner(), which take

blockedlockslock and cl_lock.