DEBIAN-CVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent lock owner use-after-free during client teardown  destroyclient() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on clownerstrhashtbl.  clienthasstate() does not count a bare owner, so DESTROYCLIENTID can reach destroyclient() with such owners present.  destroyclient() then walks the table, calling removeblockedlocks() on each owner without a reference.  Freeing a blocked lock drops the owner reference held via flcowner.  The per-net laundromat reaps blocked locks from nn->blockedlockslru independently of client state. The two paths share blockedlockslock only for the list splice, not the owner's lifetime.  The laundromat therefore frees the owner as destroyclient() dereferences it, a NULL dereference in removeblockedlocks().  nfsd4releaselockowner() holds a reference across the same call; _destroyclient() does not.  Hold cllock across the walk, taking a reference and unhashing each owner, then drop it before removeblockedlocks() and nfs4putstateowner(), which take blockedlockslock and cllock.