SB2026091297 - Race condition in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-89686)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in nfsd4_alloc_layout_stateid when concurrently revoking a delegation and processing a LAYOUTGET request. A remote attacker can send concurrent NFS requests that trigger delegation recall and layout-state allocation to cause a denial of service.

Exploitation requires one NFS client to hold a delegation and fail to respond to its recall while another client opens the same file.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/607a56fea772c1f4f4989d8e255dd4f7192d9604
• https://git.kernel.org/stable/c/97bda8b4284d90897a1f1922e5082ff9e35d7c7e
• https://git.kernel.org/stable/c/c517f27498757e616d2a8fe6d16caad1fee422e6
• https://git.kernel.org/stable/c/ca94ba36172046be6a694a7986f6931e47ed4d51