CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved:

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In nfs4preprocessseqid_op() the stateid is obtained from

nfsd4lookupstateid(), which holds a reference on the nfs4_stid

(sc_count) but takes no reference on the stateowner. openlockstateid()

merely casts that stid and likewise takes no reference.

When nfsd4cstateassign_replay() returns -EAGAIN (the replay owner is

being torn down, RP_UNHASHED) it has not taken a stateowner reference on

that path. The error handling nevertheless called

nfs4putstateowner(stp->ststateowner), dropping an socount reference

the function never acquired -- risking a stateowner refcount underflow and

use-after-free -- while leaking the sc_count reference held on the stid.

The leaked stid reference can also stall a concurrent

nfsd4closeopenstateid() waiting for sccount to drop.

Drop the reference actually held -- the stid -- before retrying. The

stateowner stays alive through the reference held by the stid. This mirrors

the open path in nfsd4processopen1(), where the put balances a reference

that path explicitly holds on the stateowner.