CVE-2026-23050: pNFS: Fix a deadlock when returning a delegation during open()
In the Linux kernel, the following vulnerability has been resolved:
pNFS: Fix a deadlock when returning a delegation during open()
Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] schedule at ffffffff9ca05415 1 [ffffd0b50e177548] schedule at ffffffff9ca05717 2 [ffffd0b50e177558] bitwait at ffffffff9ca061e1 3 [ffffd0b50e177568] waitonbit at ffffffff9ca05cfb 4 [ffffd0b50e1775c8] outoflinewaitonbit at ffffffff9ca05ea5 5 [ffffd0b50e177618] pnfsroc at ffffffffc154207b [nfsv4] 6 [ffffd0b50e1776b8] nfs4procdelegreturn at ffffffffc1506586 [nfsv4] 7 [ffffd0b50e177788] nfs4procdelegreturn at ffffffffc1507480 [nfsv4] 8 [ffffd0b50e1777f8] nfsdoreturndelegation at ffffffffc1523e41 [nfsv4] 9 [ffffd0b50e177838] nfsinodesetdelegation at ffffffffc1524a75 [nfsv4] 10 [ffffd0b50e177888] nfs4processdelegation at ffffffffc14f41dd [nfsv4] 11 [ffffd0b50e1778a0] nfs4opendatatonfs4state at ffffffffc1503edf [nfsv4] 12 [ffffd0b50e1778c0] nfs4openandgetstate at ffffffffc1504e56 [nfsv4] 13 [ffffd0b50e177978] nfs4doopen at ffffffffc15051b8 [nfsv4] 14 [ffffd0b50e1779f8] nfs4doopen at ffffffffc150559c [nfsv4] 15 [ffffd0b50e177a80] nfs4atomicopen at ffffffffc15057fb [nfsv4] 16 [ffffd0b50e177ad0] nfs4fileopen at ffffffffc15219be [nfsv4] 17 [ffffd0b50e177b78] dodentryopen at ffffffff9c09e6ea 18 [ffffd0b50e177ba8] vfsopen at ffffffff9c0a082e 19 [ffffd0b50e177bd0] dentryopen at ffffffff9c0a0935
The issue is that the delegreturn is being asked to wait for a layout return that cannot complete because a state recovery was initiated. The state recovery cannot complete until the open() finishes processing the delegations it was given.
The solution is to propagate the existing flags that indicate a non-blocking call to the function pnfsroc(), so that it knows not to wait in this situation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1059.65~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.65~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-117.117.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1054.57~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1054.55~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-117.117~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1051.52~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-117.117 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1056.62 - Upgrade
Upgrade
ubuntu/linux-azure-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1021.21~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1058.65 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1021.24~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1054.60 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1041.44 - Upgrade
Upgrade
ubuntu/linux-hwe-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-41.41~24.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1055.56 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-117.117.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1054.57 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1031.31 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1054.57.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1024.24 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1030.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1054.55 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1019.19~24.04.3 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1056.60 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1022.26 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2045.46 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1051.52 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1018.20~24.04.1 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1059.65+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-116.116+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61+fips1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.69-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.18.8-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.130 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.67 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.7
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
The affected software list consists of Ubuntu Linux kernel packages, including linux, linux-azure, linux-gcp, linux-oracle, linux-fips, and the listed cloud and FIPS variants. The reported failure occurs in the NFSv4/pNFS code path while processing a delegation during an open operation.
What is the operational impact if this issue is triggered?
The reported symptom is a kernel hang caused by a deadlock. The stack trace shows execution waiting in pnfs_roc while a delegation return is being handled during open().
How can I investigate whether a host is encountering this problem?
Check for hung tasks or kernel stack traces involving pnfs_roc, nfs4_proc_delegreturn, nfs_do_return_delegation, nfs_inode_set_delegation, and nfs4_do_open. Affected events occur when an NFSv4/pNFS delegation is returned as part of opening a file.