Executive brief
The Linux kernel's NFS server (NFSD) component has a race condition in how it allocates layout state identifiers when NFS clients request file layout information. An attacker with NFS network access can trigger a kernel crash by coordinating actions across multiple NFS client connections while files are being delegated, causing a denial of service to the NFS server and disrupting all users relying on that server.
Technical details
This is a race condition (CWE-362) in fs/nfsd/nfs4layouts.c within the nfsd4_alloc_layout_stateid() function. The vulnerability occurs when the function reads the fp->fi_deleg_file pointer without holding the necessary fi_lock spinlock, while a concurrent delegation revocation via the laundromat (housekeeping daemon) can clear this pointer under its own lock. When this race occurs, nfsd_file_get() returns NULL, triggering a BUG_ON() that crashes the kernel. The race is client-reachable: one NFS client holding a delegation while another opens the same file forces a recall; if the first client ignores the recall, the laundromat revokes the delegation; a concurrent LAYOUTGET request hits the window where fi_deleg_file has been cleared. The fix adds proper spinlock acquisition around the fi_deleg_file read and replaces the fatal BUG_ON() with graceful error handling. Patches were committed in May 2026 and backported to stable kernel versions.
Affected products
- Linux Linux kernel Introduced in an earlier version (c5c707f96fc9); affects versions prior to the patch committed 2026-05-30
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-05-30: patched: Fix committed upstream by Jeff Layton
- 2026-09-07: other: Backported to stable kernels by Greg Kroah-Hartman