Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recall

Impact

When queueing a delegation recall fails, the refcount is dropped but NFSD4_CALLBACK_RUNNING is left set, and the only code that clears it runs from the workqueue that never started. The bit becomes a permanent latch on that delegation: every later break_lease hits the early-return guard, the delegation is never recalled, and the conflicting open or lock stalls forever. On a shared fleet this shows up as one client silently wedging a file for everybody else - training runs blocking on a checkpoint that no timeout will release.

Who can reach it

No direct attacker control is described; it is triggered by a failed workqueue enqueue on a server holding delegations, and the resulting stall is then visible to any NFSv4 client contending for the same file. NVD rates it network-reachable availability loss.

What to do

Update the host kernel to a stable release that clears NFSD4_CALLBACK_RUNNING on the !queued branch, then reboot the NFS server. Once a delegation is latched there is no recovery short of restarting nfsd, which drops all client state.

References

Related entries

• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High
• Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way thatCVE-2026-68093 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel (net/xfrm): A qdisc that reuses skbCVE-2023-53500 · Linux kernel (net/xfrm)High