9.8

CVE-2026-89703

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

In the Linux kernel, the following vulnerability has been resolved:

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked
delegations but does not set SC_STATUS_FREED before releasing cl_lock.
revoke_delegation() uses this flag to detect whether FREE_STATEID has
already processed the delegation -- without it, the freed delegation is
added to cl_revoked via list_add(), producing a use-after-free when
cl_revoked is later traversed in __destroy_client().

The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already
sets SC_STATUS_FREED correctly. Apply the same pattern to the
SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a
Version < d832a0587528853d45481d1faf75d4b5d062adaf
Status affected
Version 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a
Version < 1e4795766719ffd74b8cf0f2fde4a1350f8326bf
Status affected
Version 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a
Version < a6d89032e5c6620d5bb44582a72555ce07bf1c2e
Status affected
Version 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a
Version < 650d370cfbc66a96dd14d517bd704689b5bda4e5
Status affected
Version 967faa26f313a62e7bebc55d5b8122eaee43b929
Status affected
Version 6.11.6
Version < 6.12
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.12
Status affected
Version 0
Version < 6.12
Status unaffected
Version <= 6.12.*
Version 6.12.109
Status unaffected
Version <= 6.18.*
Version 6.18.50
Status unaffected
Version <= 7.2.*
Version 7.2.4
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.61% 0.472
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf
https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf
https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e
https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5