Executive brief
The Linux kernel's NFS (Network File System) client has a flaw in how it handles file access delegations granted by an NFS server. When certain error conditions occur during delegation setup, the client fails to properly return the delegation to the server, causing the server to believe the client still holds access rights it no longer has. This can cause the server to repeatedly send recall requests that the client cannot process, degrading performance and potentially causing the NFS connection to become unstable or unusable.
Technical details
The vulnerability exists in the nfs_inode_set_delegation() function in fs/nfs/delegation.c. When a server grants an NFSv4 delegation in an OPEN reply, the client must record it locally. However, three error paths in this function would return without sending a DELEGRETURN message to release the delegation—violating RFC 8881 Section 20.2.4. When the server subsequently recalls the unrecorded delegation, the client responds with NFS4ERR_BADHANDLE, causing the server to revoke the delegation and mark it for reclamation. The server then repeatedly sends SEQ4_STATUS_RECALLABLE_STATE_REVOKED in SEQUENCE replies, forcing the client's state manager into a loop. The fix adds proper delegation return calls in the three error paths: memory allocation failure, NFS_DELEGATION_RETURNING flag already set, and delegation detachment failure. Patches are available in upstream Linux and stable branches.
Affected products
- Linux Linux kernel
Timeline
- 2026-09-17: disclosed
- 2026-06-17: patched: Upstream commit 220af23d863995091f0edeb1e6aa0945b3db8b37 by Chuck Lever