CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke
nfsd4alloclayoutstateid reads fp->fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fidelegfile under filock, causing nfsdfileget() to return NULL and triggering the BUGON.
This race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall. When the first client doesn't respond to the recall, the laundromat revokes it. A concurrent LAYOUTGET from any client using the delegation stateid hits the race window.
Fix this by taking filock around the fidelegfile read in the SCTYPEDELEG path, matching the locking discipline of the findanyfile() arm, and replacing the BUGON with a graceful error return that cleans up the partially-initialized layout stateid.
Affected Software
Event History
Frequently Asked Questions
Who can realistically trigger this issue?
The race is client-reachable in an NFS deployment with at least two clients. One client must hold a delegation, while another opens the same file to force a delegation recall; if the first client does not respond, revocation by the laundromat can create the race window.
What operation must occur during the revoke race?
A concurrent LAYOUTGET using the delegation stateid must occur while the delegation is being revoked. The vulnerable path can then observe that the delegation file pointer was cleared and hit the BUG_ON.
What is the effect of the fix when the delegated file is no longer available?
The fix protects the delegation file read with fi_lock and replaces the BUG_ON with a graceful error return. It also cleans up the partially initialized layout stateid rather than crashing on the race.