Cloudanix VulnDB

CVE-2026-89692

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux can cause certain file-sharing requests to get stuck forever, potentially disrupting access to files on network servers.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to clear the NFSD4_CALLBACK_RUNNING bit after a failed delegation recall queue leaves the bit permanently set on the delegation structure, causing nfsd_break_one_deleg to silently skip all future recalls and stall conflicting open or lock operations.

Why it matters to the business

NFS file-sharing services on Linux servers can experience indefinite stalls during file access, leading to application downtime and reduced availability in environments that rely on NFS delegations for performance.

How an attack unfolds

An attacker triggers a delegation recall queue failure to latch the running bit permanently, then issues NFS open or lock requests that conflict with the affected delegation; because recalls are now skipped, the operations stall without resolution.

How to fix it

Apply the upstream kernel patch that clears NFSD4_CALLBACK_RUNNING on the failure path in nfsd_break_one_deleg. Rebuild and deploy updated Linux kernel packages on all affected NFS servers.

How to confirm the fix worked

Inspect the nfsd_break_one_deleg function in fs/nfsd/nfs4state.c to confirm the bit-clearing logic exists on the !queued branch; test by forcing a queue failure and verifying subsequent recalls succeed.

Typical attack path

  1. Cause nfsd4_run_cb to fail when queuing a delegation recall
  2. Issue conflicting NFS open or lock operations against the same delegation
  3. Observe indefinite stall as the break_lease guard prevents further recall attempts

How to detect it

Review kernel logs on NFS servers for nfsd delegation and callback errors; correlate with client-side reports of hung open or lock operations on delegated files.

What your security team should do

  • Schedule kernel updates for all NFS servers within standard change windows given the stable low EPSS and lack of KEV listing
  • Monitor NFS server logs and client operation latency for signs of delegation stalls
  • Consider disabling delegations temporarily on high-risk servers if stalls are observed

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit at entry to serialize recall work, then calls nfsd4_run_cb() to queue the recall. When the queue attempt fails the refcount bump is undone, but the RUNNING bit is left set. The only site that clears the bit is nfsd41_destroy_cb() (fs/nfsd/nfs4callback.c), which runs from the workqueue and is therefore unreachable when nothing was queued. The bit becomes a permanent latch on dp->dl_recall.cb_flags: every subsequent break_lease() on the same delegation hits the early-return guard in nfsd_break_one_deleg() and silently skips the recall, so the delegation is never broken and the conflicting open or lock stalls. Fix by clearing NFSD4_CALLBACK_RUNNING on the !queued branch alongside the refcount_dec.

Affected packages

Ecosystem Package Introduced Fixed