Cloudanix VulnDB

CVE-2026-89686

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the Linux file-sharing service can let attackers crash the server by sending conflicting requests at the same moment.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without fi_lock under SC_TYPE_DELEG, allowing concurrent delegation revoke to clear the pointer and trigger BUG_ON on NULL return from nfsd_file_get().

Why it matters to the business

NFS servers can crash under load from multiple clients, interrupting file access for dependent applications and workloads.

How an attack unfolds

Two NFS clients coordinate so one holds a delegation while the other opens the file to trigger recall; when the first client fails to respond the laundromat revokes the delegation; a simultaneous LAYOUTGET using the delegation stateid hits the unprotected read and causes the kernel BUG.

How to fix it

Apply the upstream fix that acquires fi_lock around the fi_deleg_file read in the delegation path and replaces the BUG_ON with a graceful error return; install the corresponding kernel update once released.

How to confirm the fix worked

Confirm the locking change around fi_deleg_file in nfsd4_alloc_layout_stateid and absence of the BUG_ON; test with concurrent delegation revoke plus LAYOUTGET workloads.

Typical attack path

  1. Obtain delegation via one NFS client
  2. Issue conflicting open from second client to force recall
  3. Send LAYOUTGET using the delegation stateid during revocation window
  4. Trigger NULL dereference and BUG_ON

How to detect it

Inspect kernel logs and dmesg for BUG_ON or oops entries referencing nfsd4_alloc_layout_stateid, fi_deleg_file, or delegation revoke paths; correlate with NFS client traffic showing rapid delegation recall and layout operations.

  • BUG_ON.*nfsd4_alloc_layout_stateid
  • fi_deleg_file.*NULL
  • nfsd:.*delegation revoke.*layout stateid

What your security team should do

  • Patch Linux kernels running nfsd as soon as fixed packages are available
  • Temporarily restrict NFSv4.1+ layout and delegation features if unpatched exposure cannot be tolerated
  • Enable kernel panic logging and monitoring for nfsd-related oops

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering the BUG_ON. This race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall. When the first client doesn't respond to the recall, the laundromat revokes it. A concurrent LAYOUTGET from any client using the delegation stateid hits the race window. Fix this by taking fi_lock around the fi_deleg_file read in the SC_TYPE_DELEG path, matching the locking discipline of the find_any_file() arm, and replacing the BUG_ON with a graceful error return that cleans up the partially-initialized layout stateid.

Affected packages

Ecosystem Package Introduced Fixed