{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "eec7620800081e27dbf8019ac2e66259f0d5bf6f"
            },
            {
              "fixed": "69ed78b6b947c9257213164678b4edf17533093b"
            },
            {
              "fixed": "00843074d9b84824552c9679d423d29500ca5de0"
            },
            {
              "fixed": "f7cb90ddc021747fc9abfd4cf5252d425fd34eec"
            },
            {
              "fixed": "5e4627d3513e60accfce9d5f4c7fa95251ef93d6"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.10.0"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89688.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: drop the stateid, not the stateowner, on seqid_op replay retry\n\nIn nfs4_preprocess_seqid_op() the stateid is obtained from\nnfsd4_lookup_stateid(), which holds a reference on the nfs4_stid\n(sc_count) but takes no reference on the stateowner. openlockstateid()\nmerely casts that stid and likewise takes no reference.\n\nWhen nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is\nbeing torn down, RP_UNHASHED) it has not taken a stateowner reference on\nthat path. The error handling nevertheless called\nnfs4_put_stateowner(stp-\u003est_stateowner), dropping an so_count reference\nthe function never acquired -- risking a stateowner refcount underflow and\nuse-after-free -- while leaking the sc_count reference held on the stid.\nThe leaked stid reference can also stall a concurrent\nnfsd4_close_open_stateid() waiting for sc_count to drop.\n\nDrop the reference actually held -- the stid -- before retrying. The\nstateowner stays alive through the reference held by the stid. This mirrors\nthe open path in nfsd4_process_open1(), where the put balances a reference\nthat path explicitly holds on the stateowner.",
  "id": "CVE-2026-89688",
  "modified": "2026-09-13T03:30:16.004765840Z",
  "published": "2026-09-11T19:46:09.322Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/00843074d9b84824552c9679d423d29500ca5de0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5e4627d3513e60accfce9d5f4c7fa95251ef93d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/69ed78b6b947c9257213164678b4edf17533093b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f7cb90ddc021747fc9abfd4cf5252d425fd34eec"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89688.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89688"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "nfsd: drop the stateid, not the stateowner, on seqid_op replay retry"
}