The Linux kernel NFSD component had a use-after-free vulnerability (CVE-2026-89659) caused by delegation stateids holding bare pointers to their owning nfs4_client without keeping the client alive. The nfs4_laundromat() function temporarily removed the delegation from tracking lists, causing client_has_state() to incorrectly report no remaining state. This allowed a client to be freed prematurely while revoke_delegation() still accessed client locks, leading to a use-after-free. The patch pins the client with cl_rpc_users during revoke to block teardown until completion and properly reaps delegations, preventing the use-after-free condition.

This vulnerability could lead to use-after-free conditions in the Linux kernel NFSD component, potentially causing kernel crashes or undefined behavior. There is no indication of known exploits in the wild. The impact is limited to affected kernel versions running the NFSD delegation code.

A fix has been implemented in the Linux kernel to address this vulnerability by ensuring proper client reference counting during delegation revocation. Users should apply the official kernel updates that include this patch. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation.