CVE-2026-22989

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check that server is running in unlock_filesystem

If we are trying to unlock the filesystem via an administrative interface and nfsd isn't running, it crashes the server. This happens currently because nfsd4revokestates() access state structures (eg., confidhashtbl) that has been freed as a part of the server shutdown.

[ 59.465072] Call trace: [ 59.465308] nfsd4revokestates+0x1b4/0x898 [nfsd] (P) [ 59.465830] writeunlockfs+0x258/0x440 [nfsd] [ 59.466278] nfsctltransactionwrite+0xb0/0x120 [nfsd] [ 59.466780] vfswrite+0x1f0/0x938 [ 59.467088] ksyswrite+0xfc/0x1f8 [ 59.467395] _arm64syswrite+0x74/0xb8 [ 59.467746] invokesyscall.constprop.0+0xdc/0x1e8 [ 59.468177] doel0svc+0x154/0x1d8 [ 59.468489] el0svc+0x40/0xe0 [ 59.468767] el0t64synchandler+0xa0/0xe8 [ 59.469138] el0t64sync+0x1ac/0x1b0

Ensure this can't happen by taking the nfsdmutex and checking that the server is still up, and then holding the mutex across the call to nfsd4revoke_states().