Answer in brief
CVE-2026-89688 records a Critical severity (CVSS 9.8) vulnerability in nfsd: drop the stateid, not the stateowner, on seqid_op replay retry. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=eec7620800081e27dbf8019ac2e66259f0d5bf6f <69ed78b6b947c9257213164678b4edf17533093b || >=eec7620800081e27dbf8019ac2e66259f0d5bf6f <00843074d9b84824552c9679d423d29500ca5de0 || >=eec7620800081e27dbf8019ac2e66259f0d5bf6f <f7cb90ddc021747fc9abfd4cf5252d425fd34eec || >=eec7620800081e27dbf8019ac2e66259f0d5bf6f <5e4627d3513e60accfce9d5f4c7fa95251ef93d6 | 69ed78b6b947c9257213164678b4edf17533093b, 00843074d9b84824552c9679d423d29500ca5de0, f7cb90ddc021747fc9abfd4cf5252d425fd34eec, 5e4627d3513e60accfce9d5f4c7fa95251ef93d6 |
| Linux/Linuxgeneric | 6.10 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry In nfs4_preprocess_seqid_op() the stateid is obtained from nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid (sc_count) but takes no reference on the stateowner. openlockstateid() merely casts that stid and likewise takes no reference. When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is being torn down, RP_UNHASHED) it has not taken a stateowner reference on that path. The error handling nevertheless called nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference the function never acquired -- risking a stateowner refcount underflow and use-after-free -- while leaking the sc_count reference held on the stid. The leaked stid reference can also stall a concurrent nfsd4_close_open_stateid() waiting for sc_count to drop. Drop the reference actually held -- the stid -- before retrying. The stateowner stays alive through the reference held by the stid. This mirrors the open path in nfsd4_process_open1(), where the put balances a reference that path explicitly holds on the stateowner.
Quoted source text, attributed separately from HOL analysis.