Executive brief
The Linux kernel's NFS server (nfsd) has a flaw in how it manages delegation recalls—a mechanism used to revoke file access permissions granted to NFS clients. When a callback queue attempt fails, a flag remains set indefinitely, causing subsequent attempts to revoke delegations to be silently skipped. This results in clients retaining file access they should no longer have, leading to stalled operations and potential file locking conflicts.
Technical details
The vulnerability exists in the nfsd_break_one_deleg() function (fs/nfsd/nfs4state.c) in the NFS4 delegation handling code. The function sets the NFSD4_CALLBACK_RUNNING flag via test_and_set_bit to serialize recall work, then calls nfsd4_run_cb() to queue the recall callback. When the queue attempt fails, the refcount is decremented but the RUNNING flag is not cleared. Since nfsd41_destroy_cb()—the only code path that clears this flag—runs in the workqueue and is unreachable if nothing was queued, the flag becomes permanently latched. Subsequent break_lease() calls exit early due to the flag check in nfsd_break_one_deleg(), silently skipping the recall and leaving delegations unbroken, causing conflicting opens or locks to stall. The fix adds an explicit clear_bit(NFSD4_CALLBACK_RUNNING, ...) call on the failed-queue path.
Affected products
- Linux Linux kernel Multiple versions across linux-2.6.11 through linux-7.2 (see stable branch references in advisory)
Timeline
- 2026-09-11: disclosed: CVE published on NVD
- 2026-05-26: patched: Upstream fix committed by Jeff Layton
- 2026-09-07: patched: Backported to stable trees by Greg Kroah-Hartman