CVE-2026-89703

In the Linux kernel, the following vulnerability has been resolved:

nfsd: set SCSTATUSFREED in nfsd4droprevoked_stid for delegations

nfsd4droprevokedstid() handles FREESTATEID for admin-revoked

delegations but does not set SCSTATUSFREED before releasing cl_lock.

revokedelegation() uses this flag to detect whether FREESTATEID has

already processed the delegation -- without it, the freed delegation is

added to clrevoked via listadd(), producing a use-after-free when

clrevoked is later traversed in destroyclient().

The SCSTATUSREVOKED path in nfsd4freestateid() (line 7983) already

sets SCSTATUSFREED correctly. Apply the same pattern to the

SCSTATUSADMINREVOKED path in nfsd4droprevokedstid().