DEBIAN-CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent client use-after-free during admin state revocation  A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it.  The client survives only because destroyclient() drains its stateids before freeclient() runs.  nfsd4revokestates() drops nn->clientlock across revokeonestid(), which dereferences the client to revoke a stateid and read clp->clminorversion.  A teardown racing the dropped lock can free the client first.  Pinning clrpcusers under clientlock blocks the DESTROYCLIENTID and EXCHANGEID teardown, which refuses while clrpcusers is non-zero. forceexpireclient() ignores it: once its wait for clrpcusers to reach zero has passed, a later pin goes unnoticed.  Under clientlock, skip a client whose cltime is already zero -- forceexpireclient() clears it there before waiting -- otherwise pin clrpcusers before dropping the lock.  The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.