CVE-2026-89686
Received Received - Intake

Race Condition in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering the BUG_ON. This race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall. When the first client doesn't respond to the recall, the laundromat revokes it. A concurrent LAYOUTGET from any client using the delegation stateid hits the race window. Fix this by taking fi_lock around the fi_deleg_file read in the SC_TYPE_DELEG path, matching the locking discipline of the find_any_file() arm, and replacing the BUG_ON with a graceful error return that cleans up the partially-initialized layout stateid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89686
EUVD
EUVD-2026-76598

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition vulnerability in the Linux kernel's NFS server (nfsd). It occurs when two NFS clients interact with the same file while one holds a delegation. A delegation revoke by the server's laundromat thread can clear a file pointer while another client tries to access it, causing a null pointer dereference and triggering a kernel bug check (BUG_ON).

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation and requires kernel-level detection. Monitor kernel logs for BUG_ON errors related to nfsd4_alloc_layout_stateid or NFS delegation issues. Check for kernel crashes or hangs during NFS operations. Use commands like dmesg | grep -i nfsd or journalctl -k | grep -i nfsd to inspect kernel logs for related errors.

Impact Analysis

If exploited, this could cause a kernel panic or system crash on a Linux system running an affected NFS server. It may lead to denial of service for NFS clients and disrupt file sharing operations. The race condition requires specific client interactions, making it difficult to trigger but still a serious issue.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling NFS delegation features temporarily or restricting NFS client access until the kernel is updated. Monitor NFS server stability closely after applying mitigations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart