CVE-2026-89659

A use-after-free vulnerability exists in the Linux kernel's NFSD (NFSv4 server) subsystem during delegation revocation. A delegation stateid holds only a bare pointer to its owning nfs4_client without keeping it alive. The nfs4_laundromat() function breaks the safety invariant: it unhashes an exp...

CVE-2025-21795

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4shutdowncallback If nfs4client is in courtesy state then there is no point to send the callback. This causes nfsd4shutdowncallback to hang since clcbinflight is not 0. This hang lasts about 15 minutes until...