Linux kernel NFSv4 client: dropped delegations leave the state manager looping on revoked state

Impact

Three error paths in nfs_inode_set_delegation() return without sending DELEGRETURN, so the server still believes the client holds a delegation the client has no record of. A later CB_RECALL is answered with NFS4ERR_BADHANDLE, the server revokes the delegation and parks it on cl_revoked, and because the client never sends FREE_STATEID the condition never drains: every SEQUENCE reply carries SEQ4_STATUS_RECALLABLE_STATE_REVOKED and the client's state manager loops issuing TEST_STATEID. The record notes the window is easy to reach now that servers hand out a write delegation on any write OPEN. For a fleet whose datasets and checkpoints live on NFS, the effect is a client stuck burning CPU in recovery with degraded or stalled I/O on that mount until the node is rebooted.

Who can reach it

Local - no attacker needed. It is a race between a delegation recall for one opener and a re-open that the server answers with a fresh write delegation, so any normal write workload on an NFSv4 mount can trigger it. Exposure is limited to nodes mounting NFSv4 with delegations in use.

What to do

Update to a stable kernel that returns the delegation on these error flows (five stable commits are linked; no single fixed version is given in the record). Kernel change on every NFS client node: drain and reboot. A node already in the looping state needs a reboot to clear it; remounting does not reset the server's revoked-state list.

References

Related entries

• Linux qla2xxx: dying NPIV vport re-inserted into host_map during report ID acquisition, causing use-after-freeCVE-2026-97531 · Linux kernel scsi/qla2xxx (report ID acquisition vs. vport deletion)High
• Linux qla2xxx: pending qpair work runs after response queue teardown, causing use-after-freeCVE-2026-97536 · Linux kernel scsi/qla2xxx (queue pair teardown, qla25xx_free_rsp_que)High
• Linux nvme: sparse NSID gaps make namespace scan iterate billions of times, causing soft lockupCVE-2026-98056 · Linux kernel nvme core (nvme_scan_ns_list stale-namespace removal)High
• Linux kernel libiscsi_tcp: a Data-In PDU naming a WRITE command's ITT overwrites the writer's own pagesCVE-2026-98479 · Linux kernel libiscsi_tcp (Data-In PDU direction check in iscsi_tcp_hdr_dissect)High
• Linux kernel nvmet: metadata SGL allocation failure frees the data SGL against an unassigned p2p deviceCVE-2026-98964 · Linux kernel nvmet (P2P device handling in nvmet_req_alloc_p2pmem_sgls error path)High
• Linux kernel ice: relaxed Tx doorbell write on arm64 trips a BUG_ON in dql_completed and panics the hostCVE-2026-98965 · Linux kernel ice driver (Tx doorbell MMIO ordering on arm64)High