CVE-2026-89703

A flaw was found in the nfsd component of the Linux kernel. The nfsd4_drop_revoked_stid() function, which handles admin-revoked delegations, fails to correctly set a status flag before releasing a lock. This oversight can lead to a use-after-free condition when a freed delegation is incorrectly added to a list, potentially allowing an attacker to cause a denial of service or execute arbitrary code.

A use-after-free can occur in the NFS server state handling path because nfsd4_drop_revoked_stid releases an admin revoked delegation without marking the stateid as freed. A concurrent revoke_delegation path can then treat the same delegation as not yet processed and add the already freed object to the cl_revoked list. Later traversal of cl_revoked in client teardown can dereference freed memory and crash the kernel. For the CVSS the PR:L is selected because reliable triggering normally requires an NFSv4 client context with access to the affected export or session, not local root on the victim. The issue is network reachable through the NFS server control and state protocol paths, but exploitation requires a specific revoked delegation and FREE_STATEID timing window. Impact is at least denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.