CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved:

nfsd: revoke copy-notify stateids before dropping their reference

Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent

stid's sc_cp_list, pinned by a single membership reference.

_free_cpntf_state_locked() only unlinks an entry once its refcount reaches

zero, so any revoke path that runs while a concurrent

find_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops

the reference without unlinking, leaving the entry discoverable with its

membership reference already consumed. A second revoke or a laundromat tick

then frees it while the reader still holds the pointer -- a

KASAN-detectable use-after-free at the reader's nfs4_put_cpntf_state().

This affected all three revoke paths:

- The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called

_free_cpntf_state_locked() on the first list entry; a holder that had

bumped cs_count made it return early, so the next iteration

re-decremented and burned the holder's reference.

- OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise

used _free_cpntf_state_locked() and could drop 2->1 without unlinking.

Add revoke_cpntf_state_locked(), which unhashes the entry from the IDR and

sc_cp_list first (deferring the final free to any holder), and use it from

all three revoke paths. The drain now walks with list_for_each_entry_safe()

and revokes each entry unconditionally, so it terminates in one pass per

entry regardless of cs_count. The unhash is gated on

!list_empty(&cps->cp_list); the idr_remove() gate matters because

idr_alloc_cyclic() may have recycled the so_id by then. Keep

_free_cpntf_state_locked() for the reference-holder put path only, where a

concurrent revoke may already have unlinked the entry (its list_del_init()

then a no-op).