Linux nfsd: pNFS layout fence worker takes a duplicate reference and leaks the layout stateid

Impact

The workqueue core clears WORK_STRUCT_PENDING before running the callback, so delayed_work_pending() in lm_breaker_timedout() can report no work pending while the fence worker is already running. The breaker then takes a second sc_count reference and queues a worker that coalesces with the in-flight one, and the extra reference is never dropped - the layout stateid leaks. On a pNFS-serving metadata server this is an unbounded kernel memory leak driven by clients that hold layouts and do not return them, degrading a storage node that a whole GPU cluster mounts. No memory corruption is described; the impact is resource exhaustion over time.

Who can reach it

An NFSv4.1 pNFS client holding layouts that let the server's layout breaker time out. Ordinary client access to the export; no server-side privilege.

What to do

Roll a kernel with one of the linked stable commits onto the NFS server and reboot. Only servers exporting pNFS layouts are affected; a server that does not hand out layouts has nothing to fence. As an interim measure, monitor slab growth on the server and restart it during a maintenance window before it exhausts memory.

References

Related entries

• Linux nfsd: LAYOUTGET racing a delegation revoke hits a BUG_ON and panics the NFS serverCVE-2026-89686 · Linux NFS server (nfsd4_alloc_layout_stateid, fi_deleg_file under fi_lock)Critical
• Linux nfsd: seqid_op replay retry drops a stateowner reference it never tookCVE-2026-89688 · Linux NFS server (nfs4_preprocess_seqid_op, stateowner refcount on replay retry)Critical
• Linux nfsd: session slot shrinker frees the slot in use, corrupting the slab with reply dataCVE-2026-89689 · Linux NFS server (nfsd4_sequence session slot shrinker, free_session_slots)Critical
• Linux nfsd: fh_verify tracepoints size the server address slot wrongly, writing past the trace bufferCVE-2026-89702 · Linux NFS server (nfsd_fh_verify tracepoints, server sockaddr slot sizing)Critical
• Linux nfsd: FREE_STATEID on an admin-revoked delegation leaves it on cl_revoked as freed memoryCVE-2026-89703 · Linux NFS server (nfsd4_drop_revoked_stid, SC_STATUS_FREED on delegations)Critical
• Linux nfsd: use-after-free on cl_cb_session when a session is destroyed with a callback in flightCVE-2026-89708 · Linux NFS server (nfsd callback client, cl_cb_session lifetime on DESTROY_SESSION)Critical