Executive brief
The Linux kernel's NFS server (NFSD) component contains a race condition in its layout fence worker that can leak references to layout state objects. When lease managers request layout recalls, a timing window allows duplicate reference counts to be taken on the same layout, preventing the state from being properly freed. This can lead to kernel memory leaks and potential denial of service in systems using NFS v4.1+ layouts.
Technical details
The vulnerability is a use-after-clear race condition in the NFSD layout fence worker. The workqueue core clears WORK_STRUCT_PENDING before invoking the fence worker callback; during this window, delayed_work_pending() returns false even though the worker is still executing. This allows lm_breaker_timedout() to take a duplicate reference count and schedule a new worker that coalesces with the already-running one. The extra reference is never released, leaking the layout stateid and exhausting kernel memory. The fix replaces the racy delayed_work_pending() check with an ls_fence_inflight boolean flag that is atomically set under spinlock when taking a reference and cleared before final cleanup. The vulnerability affects any Linux kernel with NFS v4.1+ layout support that calls the affected code path; the attack vector is network-based (any NFS client can trigger lease manager callbacks).
Affected products
- Linux Linux kernel Kernel versions with NFS v4.1+ layouts (likely 5.0+, exact range not specified in advisory)
Timeline
- 2026-09-11: disclosed: CVE-2026-89681 published
- 2026-08-10: patched: Patch committed upstream by Chuck Lever
- 2026-05-31: other: Patch authored by Jeff Layton