CVE-2026-89692: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
In the Linux kernel, the following vulnerability has been resolved:
nfsd: clear CALLBACKRUNNING on failed delegation recall queue
nfsdbreakonedeleg() sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb() to queue the recall. When the queue attempt fails the refcount bump is undone, but the RUNNING bit is left set. The only site that clears the bit is nfsd41destroycb() (fs/nfsd/nfs4callback.c), which runs from the workqueue and is therefore unreachable when nothing was queued.
The bit becomes a permanent latch on dp->dlrecall.cbflags: every subsequent breaklease() on the same delegation hits the early-return guard in nfsdbreakonedeleg() and silently skips the recall, so the delegation is never broken and the conflicting open or lock stalls.
Fix by clearing NFSD4CALLBACKRUNNING on the !queued branch alongside the refcountdec.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems running the nfsd NFS server and using delegation recall handling are relevant. The failure path is reached when queuing a delegation recall callback fails.
What happens after a failed delegation recall queue attempt?
The callback-running flag can remain set permanently for that delegation. Later attempts to break the same delegation are skipped, leaving conflicting open or lock operations stalled.
How might this appear operationally?
A conflicting client open or lock can stall because the affected delegation is never recalled and broken. The condition follows a prior failure to queue that delegation's recall callback.