CVE-2026-89681

A race condition in the Linux kernel's NFS server (nfsd) allows a duplicate reference to be taken on a pNFS layout stateid. The workqueue core clears WORK_STRUCT_PENDING before a delayed-work callback runs, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already executing; the layout breaker then takes an extra sc_count reference and schedules a worker that coalesces with the in-flight one, and that extra reference is never put back, leaking the layout stateid. In practice this is a kernel memory leak on the NFS server that can be repeatedly induced by clients that stall layout returns (or by ordinary recall contention), potentially exhausting memory and degrading or crashing the service over time; despite the assigned 9.8 CVSS base score, the fix description indicates a reliability/availability flaw, not code execution or data disclosure. Affected systems are Linux kernels running nfsd as a pNFS server that hands out layouts. There is no public proof of concept, the issue is not in the CISA KEV catalog, and no exploitation is known.

What to do: Upgrade to a kernel that carries the nfsd fix (the ls_fence_inflight refcount/flag rework, plus removal of the self-rearming mod_delayed_work()) as soon as your distribution ships it — check your vendor's kernel changelog for the 'nfsd: fix layout fence worker double-reference race' commit. Until patched, monitor pNFS servers for steady slab/kernel memory growth from leaked stateids and recycle nfsd if pressure appears. Servers not exporting pNFS layouts do not exercise this code path and face little practical risk from this bug.