CVE-2026-89688

A flaw was found in the Linux kernel's nfsd component. During a seqid_op replay retry, the system incorrectly handles reference counts for stateowners, leading to a reference count underflow and a use-after-free vulnerability. This issue could allow an attacker to potentially cause a denial of service or execute arbitrary code.

An NFS server state handling bug can occur in nfs4_preprocess_seqid_op because the retry path drops a stateowner reference that was not acquired while leaking the stid reference that was actually held. This can cause stateowner refcount underflow and a possible use-after-free, and the leaked stid reference can also stall close processing that waits for sc_count to drop. For the CVSS the PR:L is used because a remote attacker typically needs NFS access sufficient to create or replay NFSv4 stateful operations, but does not need local code execution on the server. The issue is network reachable when the NFS server is exposed to the attacker, although NFS services are usually limited to trusted storage or internal networks. Impact is at least denial of service via kernel crash or stuck state cleanup, and in the paranoid case may include confidentiality and integrity impact due to the UAF class.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.