In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry In nfs4_preprocess_seqid_op() the stateid is obtained from nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid (sc_count) but takes no reference on the stateowner. openlockstateid() merely casts that stid and likewise takes no reference. When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is being torn down, RP_UNHASHED) it has not taken a stateowner reference on that path. The error handling nevertheless called nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference the function never acquired -- risking a stateowner refcount underflow and use-after-free -- while leaking the sc_count reference held on the stid. The leaked stid reference can also stall a concurrent nfsd4_close_open_stateid() waiting for sc_count to drop. Drop the reference actually held -- the stid -- before retrying. The stateowner stays alive through the reference held by the stid. This mirrors the open path in nfsd4_process_open1(), where the put balances a reference that path explicitly holds on the stateowner.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the
    stateowner, on seqid_op replay retry In nfs4_preprocess_seqid_op() the stateid is obtained from
    nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid (sc_count) but takes no reference on the
    stateowner. openlockstateid() merely casts that stid and likewise takes no reference. When
    nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is being torn down, RP_UNHASHED) it has not
    taken a stateowner reference on that path. The error handling nevertheless called
    nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference the function never acquired --
    risking a stateowner refcount underflow and use-after-free -- while leaking the sc_count reference held on
    the stid. The leaked stid reference can also stall a concurrent nfsd4_close_open_stateid() waiting for
    sc_count to drop. Drop the reference actually held -- the stid -- before retrying. The stateowner stays
    alive through the reference held by the stid. This mirrors the open path in nfsd4_process_open1(), where
    the put balances a reference that path explicitly holds on the stateowner. (CVE-2026-89688)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nfsd: drop the stateid, not the stateowner, on seqid_op replay retry In nfs4_preprocess_seqid_op() the     stateid is obtained from nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid (sc_count) but     takes no reference on the stateowner. openlockstateid() merely casts that stid and likewise takes no     reference. When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is being torn down,     RP_UNHASHED) it has not taken a stateowner reference on that path. The error handling nevertheless called     nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference the function never acquired --     risking a stateowner refcount underflow and use-after-free -- while leaking the sc_count reference held on     the stid. The leaked stid reference can also stall a concurrent nfsd4_close_open_stateid() waiting for     sc_count to drop. Drop the reference actually held -- the stid -- before retrying. The stateowner stays     alive through the reference held by the stid. This mirrors the open path in nfsd4_process_open1(), where     the put balances a reference that path explicitly holds on the stateowner. (CVE-2026-89688)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472689	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Cloud Security	Google COS Security Checks	Local	critical
472689	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	critical
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345083	Linux Distros Unpatched Vulnerability : CVE-2026-89688	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-89688

critical

Tenable Plugins

critical

critical

high

high

critical