Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recall

CVSS 7.5CVE-2026-89692Kernel, userspace & hypervisorcurated

Impact

When queueing a delegation recall fails, the refcount is dropped but NFSD4_CALLBACK_RUNNING is left set, and the only code that clears it runs from the workqueue that never started. The bit becomes a permanent latch on that delegation: every later break_lease hits the early-return guard, the delegation is never recalled, and the conflicting open or lock stalls forever. On a shared fleet this shows up as one client silently wedging a file for everybody else - training runs blocking on a checkpoint that no timeout will release.

Who can reach it

No direct attacker control is described; it is triggered by a failed workqueue enqueue on a server holding delegations, and the resulting stall is then visible to any NFSv4 client contending for the same file. NVD rates it network-reachable availability loss.

What to do

Update the host kernel to a stable release that clears NFSD4_CALLBACK_RUNNING on the !queued branch, then reboot the NFS server. Once a delegation is latched there is no recovery short of restarting nfsd, which drops all client state.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89692 https://git.kernel.org/stable/c/b036727d334b1b7cd4c1f1fba3b59ba93a6bbe96 https://git.kernel.org/stable/c/b137930ee52e3ef38915a3511d4c070463b63a32 https://git.kernel.org/stable/c/cb2d0c4d1b3d301d042ed61365eaa8cb0141a254

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.