CVE-2026-89703

Katalog CVE

CVSS 9.8 · Critical EPSS 0,62%

Skor CVSS 3.1 9.8 (Critical) menurut CNA.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before releasing cl_lock. revoke_delegation() uses this flag to detect whether FREE_STATEID has already processed the delegation -- without it, the freed delegation is added to cl_revoked via list_add(), producing a use-after-free when cl_revoked is later traversed in __destroy_client(). The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already sets SC_STATUS_FREED correctly. Apply the same pattern to the SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().

Rincian

Terbit di NVD

11 September 2026

Terakhir diubah

13 September 2026

Status NVD

Received

CVSS 3.1

9.8 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf
• https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5
• https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e
• https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf