CVE-2026-89692: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
In the Linux kernel, the following vulnerability has been resolved:
nfsd: clear CALLBACKRUNNING on failed delegation recall queue
nfsdbreakonedeleg() sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb() to queue the recall. When the queue attempt fails the refcount bump is undone, but the RUNNING bit is left set. The only site that clears the bit is nfsd41destroycb() (fs/nfsd/nfs4callback.c), which runs from the workqueue and is therefore unreachable when nothing was queued.
The bit becomes a permanent latch on dp->dlrecall.cbflags: every subsequent breaklease() on the same delegation hits the early-return guard in nfsdbreakonedeleg() and silently skips the recall, so the delegation is never broken and the conflicting open or lock stalls.
Fix by clearing NFSD4CALLBACKRUNNING on the !queued branch alongside the refcountdec.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Clear NFSD4_CALLBACK_RUNNING on the !queued branch alongside refcount_dec when the delegation recall queue attempt fails.
Linux kernel nfsd delegation recall NFSD4_CALLBACK_RUNNING = cleared
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems running the nfsd NFS server and using delegation recall handling are relevant. The failure path is reached when queuing a delegation recall callback fails.
What happens after a failed delegation recall queue attempt?
The callback-running flag can remain set permanently for that delegation. Later attempts to break the same delegation are skipped, leaving conflicting open or lock operations stalled.
How might this appear operationally?
A conflicting client open or lock can stall because the affected delegation is never recalled and broken. The condition follows a prior failure to queue that delegation's recall callback.