DEBIAN-CVE-2026-89659

In the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent client use-after-free during delegation revoke  A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive.  The client survives its stateids only because destroyclient() drains cldelegations and clrevoked before freeclient() runs.  nfs4laundromat() breaks that invariant: it unhashes an expired delegation from cldelegations, drops deleglock, then revokedelegation() relinks it onto clrevoked under cllock.  In that window the delegation is on neither list, so clienthasstate() can report no remaining state.  Every teardown path first requires clrpcusers to be zero, but the laundromat holds no such reference.  A client whose recalled delegation has just timed out can therefore reach freeclient() while revokedelegation() is still about to dereference cllock, a use-after-free.  Pin the client with clrpcusers across the revoke so teardown blocks until it completes, then reap the delegation from clrevoked.  A client already expiring reaps its own, so skip it and leave the delegation on delrecall_lru.