The Linux kernel NFSD subsystem had a use-after-free vulnerability (CVE-2026-89662) triggered during client teardown. Specifically, __destroy_client() releases a client's open owners but fails to hold the cl_lock or maintain references while iterating over lock owners, allowing the per-net laundromat to concurrently free blocked locks and their owners. This results in a NULL dereference in remove_blocked_locks() when __destroy_client() dereferences a freed owner. The fix involves holding cl_lock across the walk, taking references and unhashing each owner before calling remove_blocked_locks() and nfs4_put_stateowner(), which properly synchronize access.

The vulnerability causes a NULL pointer dereference in kernel code, which can lead to a denial of service (kernel crash). There is no information about exploitation in the wild or escalation of privileges. The impact is limited to system stability and availability.

A fix has been implemented in the Linux kernel to address this use-after-free issue by improving locking and reference handling during client teardown. Users should apply the official kernel updates that include this fix. Since this is a kernel vulnerability, patching the kernel to the fixed version is the recommended remediation.