Linux nfsd: LAYOUTGET racing a delegation revoke hits a BUG_ON and panics the NFS server

Impact

nfsd4_alloc_layout_stateid() read fp->fi_deleg_file without fi_lock on the delegation path. The laundromat can clear fi_deleg_file concurrently when it revokes an unreturned delegation, nfsd_file_get() then returns NULL and the BUG_ON fires, panicking the server. The commit states the race is client-reachable: one client holds a delegation and ignores the recall while another opens the same file to force it, and a LAYOUTGET using the delegation stateid lands in the window. A panic on the NFS server takes down shared storage for every node that mounts it - on a GPU cluster that means every running job stalls, not one tenant.

Who can reach it

Two NFSv4.1 clients with ordinary access to the same export, one holding a delegation it does not return. No server-side privilege required.

What to do

Patch the NFS server kernel with one of the linked stable commits and reboot the server; the fix takes fi_lock around the read and replaces the BUG_ON with a clean error return. There is no configuration workaround short of disabling delegations or pNFS layouts on the export.

References

Related entries

• Linux nfsd: seqid_op replay retry drops a stateowner reference it never tookCVE-2026-89688 · Linux NFS server (nfs4_preprocess_seqid_op, stateowner refcount on replay retry)Critical
• Linux nfsd: session slot shrinker frees the slot in use, corrupting the slab with reply dataCVE-2026-89689 · Linux NFS server (nfsd4_sequence session slot shrinker, free_session_slots)Critical
• Linux nfsd: fh_verify tracepoints size the server address slot wrongly, writing past the trace bufferCVE-2026-89702 · Linux NFS server (nfsd_fh_verify tracepoints, server sockaddr slot sizing)Critical
• Linux nfsd: FREE_STATEID on an admin-revoked delegation leaves it on cl_revoked as freed memoryCVE-2026-89703 · Linux NFS server (nfsd4_drop_revoked_stid, SC_STATUS_FREED on delegations)Critical
• Linux nfsd: use-after-free on cl_cb_session when a session is destroyed with a callback in flightCVE-2026-89708 · Linux NFS server (nfsd callback client, cl_cb_session lifetime on DESTROY_SESSION)Critical
• Intel Data Center Manager SDK (reference UI): The DCM SDK's reference UI allows an unauthenticated remote attackerCVE-2018-3679 · Intel Data Center Manager SDK (reference UI)Critical