CVE-2026-89686
moderateRace-condition BUG_ON in Linux kernel nfsd pNFS layout code crashes NFS servers
The Linux kernel's NFS server (nfsd) reads the fi_deleg_file pointer without holding fi_lock in nfsd4_alloc_layout_stateid when a layout stateid is created on top of a delegation. A concurrent delegation revoke by the nfsd laundromat can clear that pointer, causing nfsd_file_get() to return NULL and triggering a BUG_ON that takes down the kernel. The race is reachable by ordinary NFS clients: one client holds a delegation, a second opens the same file to force a recall, and once the unresponsive delegation is revoked, an concurrent LAYOUTGET using that delegation stateid falls into the race window. The practical impact is remote denial of service against Linux hosts acting as pNFS-serving NFS servers (nominally scored CVSS 3.1 9.8, with availability being the real-world consequence). No public proof of concept or known in-the-wild exploitation has been reported.
What to do: Upgrade to a kernel release containing this nfsd fix as soon as your distribution ships it. If pNFS layout service is not required, disable the nfsd layout drivers (avoid loading the block/SCSI/flexfiles layout modules) to remove the vulnerable path entirely. Restrict NFS exports and firewall TCP/2049 so only trusted client networks can reach nfsd, since any client with access to the export can trigger the race.
| Linux kernel (nfsd, nfsd4_alloc_layout_stateid pNFS layout handling) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering the BUG_ON. This race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall. When the first client doesn't respond to the recall, the laundromat revokes it. A concurrent LAYOUTGET from any client using the delegation stateid hits the race window. Fix this by taking fi_lock around the fi_deleg_file read in the SC_TYPE_DELEG path, matching the locking discipline of the find_any_file() arm, and replacing the BUG_ON with a graceful error return that cleans up the partially-initialized layout stateid.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.